https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43782 --- Comment #3 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- Created attachment 207995 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=207995&action=edit Bug 43782: Fix GenerateCSRF cache key to be session-specific The GenerateCSRF template plugin (added by Bug 35955) cached the CSRF token under the global key 'CSRF-TOKEN', shared across all sessions served by the same Plack worker. Because Koha::Cache::Memory::Lite is a package-level in-process hash that persists across requests, the first session's token was returned to all subsequent sessions on the same worker, causing CSRF validation to fail with 403 errors. This patch: - Changes the cache key to 'CSRF-TOKEN-{session_id}' so each session gets its own cached token - Stores the token with a timestamp and rejects cached tokens with less than one hour of remaining lifetime (CSRF_EXPIRY_HOURS * 3600 - 3600 seconds) to prevent serving near-expired tokens Test plan: 1. Apply patch 2. prove t/db_dependent/Koha/Template/Plugin/Koha.t Signed-off-by: Johan Larsson <johlar@imcode.com> Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Andrew Fuerste Henry <andrew@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.