https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43782 Bug ID: 43782 Summary: GenerateCSRF caches token with global key causing cross-session CSRF 403 errors on Plack workers Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Templates Assignee: oleonard@myacpl.org Reporter: johan@imcode.com QA Contact: testopia@bugs.koha-community.org Target Milestone: --- Bug 35955 (commit 108c955ea) introduced caching of the CSRF token in Koha::Template::Plugin::Koha::GenerateCSRF using Koha::Cache::Memory::Lite. The cache uses a static key "CSRF-TOKEN" shared across all sessions served by a Plack worker. Because Koha::Cache::Memory::Lite is a package-level in-process hash that is NOT flushed between requests (despite what its documentation says), the cached token from the first session persists and is returned to all subsequent sessions on the same worker process. When session B receives session A's token and submits a form, CSRF validation compares the token against session B's session_id — it was generated for session A — and returns 403. Symptoms: - Intermittent "Invalid CSRF token" 403 errors - Reproducible as "first request after idle period" (e.g. every morning) - Affects both intranet login and OPAC self-checkout (sco-main.pl) - Works on the second attempt (the second request gets the correct session's token because the old cached value is still returned — but a reload generates a new session and fresh token) The 8-hour CSRF_EXPIRY_HOURS (Bug 17110) made the window smaller. After Bug 42924 increased it to 168 hours, a worker running more than ~7 days could additionally serve a near-expired token with less than 1 hour remaining. Note: Bug 18124 correctly made CSRF tokens cryptographically session-specific. The cache layer introduced by Bug 35955 bypasses that protection. The issue can be hard to reproduce, so I have been using reports from customers to piece this together. -- You are receiving this mail because: You are watching all bug changes.