Know if HTTP request is from Chrome URL auto-complete?

Question

We have a web application that responds to GET /logout and deletes your session cookies. If you start typing any other URL that beings with /l into the URL bar, Chrome will auto-suggest /logout. When it does this, it makes a request to /logout to pre-fetch the content. The result is that the user is un-expectedly logged out.

How can my HTTP server know if a request is from this pre-fetch behavior?

What I've tried:

• Inspecting the request headers for something unique. I do not see anything unique from the pre-fetch request.
• Using 'Cache-Control': 'no-cache, no-store' to tell the browser to not cache the response from GET /logout

Answer 1

Change your logout to use POST instead of GET.