Security::logout() returns a redirect response

Author: GromNaN

src/Controller/UserController.php

@@ -70,11 +70,9 @@ public function changePassword(
         if ($form->isSubmitted() && $form->isValid()) {
             $entityManager->flush();
 
-            // The second argument is to disable CSRF protection before logout.
-            // A CSRF token is already verified by the form.
-            $security->logout(false);
-
-            return $this->redirectToRoute('security_login');
+            // The logout method has a protection against CSRF attacks, it's disabled here
+            // because the form already has a CSRF token validated.
+            return $security->logout(false);
         }
 
         return $this->render('user/change_password.html.twig', [

tests/Controller/UserControllerTest.php

@@ -104,12 +104,9 @@ public function testChangePassword(): void
 
         $this->assertResponseRedirects();
         $this->assertResponseRedirects(
-            '/en/login',
+            '/',
             Response::HTTP_FOUND,
             'Changing password logout the user.'
         );
-
-        $client->followRedirect();
-        $this->assertResponseStatusCodeSame(Response::HTTP_OK);
     }
 }