https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43709 Adolfo Rodríguez Taboada <adolfo.rodriguez@xercode.es> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff --- Comment #4 from Adolfo Rodríguez Taboada <adolfo.rodriguez@xercode.es> --- You're right on both counts — I have verified against the code: 1 CGISESSID is created with -HttpOnly => 1 everywhere it's set in C4/Auth.pm (9 occurrences), so Cookies.get() could never read it. That check was dead code from the start. 2 force_no_caching adds Cache-Control: no-store (C4/Output.pm), which excludes the page from bfcache — that does break the normal back-button workflow catalogers rely on after saving. v2 (attached, obsoletes 207220) keeps only the preventDefault() fix and drops the other three changes entirely, including reverting addbiblio.pl back to its unmodified state. One caveat worth being upfront about: the original 400 error (missing preventDefault racing the GET vs POST) was only ever observed in a production environment — it's timing-dependent and we were not able to reproduce it reliably on demand in a dev/KTD setup. So this v2 hasn't been locally tested against the actual failure, only confirmed to not regress normal framework-switching. Given the mechanism is well understood (an uncancelled href="#" racing a form submit()), I'm fairly confident in the fix, but flagging this since it changes what "tested" means here. The second root cause from the original description (stale CSRF token after session change + bfcache restore) is still unaddressed by this patch. It's a narrower, rarer edge case; I'll consider filing it separately with a less invasive approach (gracefully handling the 403) rather than bundling it here. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.