Just FYI: As this only solves the CSRF-part of #12540 and not the unneeded-cookie-part I have created #14402 as a followup for that issue.

just tested it and actually didn't work for me. Instead seeing above error in chrome.

In https://github.com/matomo-org/matomo/blob/3.10.0-b1/plugins/CoreAdminHome/javascripts/optOut.js#L6-L7 it actually does a GET request to the form action. You would think the form does a regular post but it opens the <form action=""> URL in a new window totally ignoring the hidden nonce input field etc.

That's why previously the nonce was before added in the redirect URL and caused the CSRF problem.

To fix it, we need to add the nonce to the form action url in https://github.com/matomo-org/matomo/blob/3.10.0-b1/plugins/CoreAdminHome/OptOutManager.php#L195-L200 . It should be totally fine to send the nonce through GET parameter.

Tested using the URL: https://$DOMAIN/index.php?module=CoreAdminHome&action=optOut&idSite=1&period=day&date=yesterday

Works 👍