https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29543 --- Comment #51 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Hmm. Why are we doing this in sco-main: L47 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( So the CGISESSID cookie is used here and we check permissions. L371 $cookie = $query->cookie( -name => 'JWT', We create a new cookie JWT. But ignore the session cookie. L381 output_html_with_http_headers $query, $cookie, $template->output, undef, { force_no_caching => 1 }; We output now without the CGISESSID, only JWT. Why dont you pass the session cookie? You could pass something like [ $cookie1, $cookie2 ] ? -- You are receiving this mail because: You are watching all bug changes.