https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43304 Bug ID: 43304 Summary: Add global CSRF header injection for legacy jQuery.ajax API calls Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: tomascohen@gmail.com QA Contact: testopia@bugs.koha-community.org Depends on: 34451 Target Milestone: --- Bug 34451 adds CSRF protection for cookie-authenticated REST API requests. The http-client.js already sends the CSRF-TOKEN header automatically, but several templates still use raw jQuery.ajax() calls to the API without the header. Affected templates include: - members/two_factor_auth.tt (POST to /api/v1/auth/two-factor/registration and /verification) - tools/manage-marc-import.tt - tools/quotes.tt, quotes-upload.tt - tools/batch_modify_holds.tt - tools/stage-marc-import.tt These calls will fail with 403 when CSRF protection is active because they send the CGISESSID cookie (browser sends it automatically) but no CSRF-TOKEN header. Proposed fix: add a global jQuery.ajaxSetup that injects the CSRF-TOKEN header from the meta tag on every state-changing request: $.ajaxSetup({ beforeSend: function(xhr, settings) { if (!/^(GET|HEAD|OPTIONS)$/i.test(settings.type)) { var token = $('meta[name="csrf-token"]').attr('content'); if (token) xhr.setRequestHeader('CSRF-TOKEN', token); } } }); This fixes all legacy callers in one shot without requiring individual template changes. It should live in a globally included JS file (e.g., js/global.js or staff-global.js). Alternatively, individual templates could be migrated to http-client.js but that is a larger effort. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.