[Bug 41104] New: Samesite HTTP response header being set in C4::Auth::checkauth()
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 Bug ID: 41104 Summary: Samesite HTTP response header being set in C4::Auth::checkauth() Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: lari.taskula@hypernova.fi QA Contact: testopia@bugs.koha-community.org "SameSite" is an attribute to a cookie. However, in Bug 26019 we have included it in as a HTTP response header for C4::Auth::checkauth(). As it is not a part of standard HTTP response headers, is there more to it, or can it be removed? https://github.com/Koha-Community/Koha/blob/59ff962caaa28c10ab1a57655ca58835... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 Lari Taskula <lari.taskula@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 --- Comment #1 from Lari Taskula <lari.taskula@hypernova.fi> --- Created attachment 188449 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188449&action=edit Bug 41104: Catch invalid response header Samesite The SameSite is an attribute to a cookie, not a standard HTTP response header. We can safely remove it. To test: 1. Before applying further patches, 2. prove t/db_dependent/Auth.t 3. Observe test failure -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 --- Comment #2 from Lari Taskula <lari.taskula@hypernova.fi> --- Created attachment 188450 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188450&action=edit Bug 41104: Remove -sameSite from checkauth() response headers To test: 1. prove t/db_dependent/Auth.t 2. Observe success -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 --- Comment #3 from Lari Taskula <lari.taskula@hypernova.fi> --- (In reply to Lari Taskula from comment #1)
Created attachment 188449 [details] [review] Bug 41104: Catch invalid response header Samesite I'm not sure this test needs to be pushed. It does not really serve any purpose in the long run, after the second patch is pushed.
-- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #4 from David Cook <dcook@prosentient.com.au> --- (In reply to Lari Taskula from comment #3)
Created attachment 188449 [details] [review] [review] Bug 41104: Catch invalid response header Samesite I'm not sure this test needs to be pushed. It does not really serve any
(In reply to Lari Taskula from comment #1) purpose in the long run, after the second patch is pushed.
Yeah, I don't think it's really necessary either. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188449|0 |1 is obsolete| | --- Comment #5 from David Cook <dcook@prosentient.com.au> --- Comment on attachment 188449 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188449 Bug 41104: Catch invalid response header Samesite I'm going to mark it as obsolete for now, because I don't think the test adds too much value for the future. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188450|0 |1 is obsolete| | --- Comment #6 from David Cook <dcook@prosentient.com.au> --- Created attachment 188452 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188452&action=edit Bug 41104: Remove -sameSite from checkauth() response headers To test: 1. prove t/db_dependent/Auth.t 2. Observe success Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|enhancement |trivial Assignee|koha-bugs@lists.koha-commun |lari.taskula@hypernova.fi |ity.org | --- Comment #7 from David Cook <dcook@prosentient.com.au> --- Good catch on this one. What a little oopsie. Super easy to test in the browser by using the F12 tools and just checking for the presence of that SameSite HTTP header on the response from the server on the load of any page. The header is there before the patch, and the header is not there after the patch. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 Lari Taskula <lari.taskula@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |38363 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38363 [Bug 38363] get_template_and_user and checkauth don't use C4::Output for rendering auth pages -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 --- Comment #8 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 189616 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189616&action=edit Bug 41104: Remove -sameSite from checkauth() response headers To test: 1. prove t/db_dependent/Auth.t 2. Observe success Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188452|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com QA Contact|testopia@bugs.koha-communit |jonathan.druart@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |25.11.00 released in| | Status|Passed QA |Pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 --- Comment #9 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 25.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Pushed to stable Version(s)|25.11.00 |25.11.00,25.05.06 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 --- Comment #10 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Nice work everyone! Pushed to 25.05.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.11.00,25.05.06 |25.11.00,25.05.06,24.11.11 released in| | CC| |fridolin.somers@biblibre.co | |m Status|Pushed to stable |Pushed to oldstable --- Comment #11 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 24.11.x for 24.11.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41104 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to oldstable |Needs documenting CC| |wainuiwitikapark@catalyst.n | |et.nz --- Comment #12 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 22.11 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org