Back to bug 33675

Who When What Removed Added
nick 2023-05-04 10:31:32 UTC Version 22.11 master
Assignee koha-bugs tomascohen
tomascohen 2023-05-09 18:20:02 UTC CC tomascohen
Status NEW ASSIGNED
tomascohen 2023-05-10 13:31:20 UTC URL https://www.oauth.com/oauth2-servers/accessing-data/authorization-request/
tomascohen 2023-05-10 13:42:25 UTC CC agustinmoyano, dcook
tomascohen 2023-05-10 16:10:04 UTC Status ASSIGNED Needs Signoff
Patch complexity --- Small patch
tomascohen 2023-05-10 16:10:20 UTC Summary OAuth should support state parameter Add CSRF protection to OAuth/OIDC authentication
dcook 2023-05-10 23:32:54 UTC Depends on 33708
dcook 2023-05-10 23:39:48 UTC Status Needs Signoff Signed Off
dcook 2023-05-10 23:39:51 UTC Attachment #151019 Attachment is obsolete 0 1
jonathan.druart 2023-05-11 08:46:14 UTC CC jonathan.druart+koha
tomascohen 2023-05-12 13:37:54 UTC Keywords rel_23_05_candidate
nick 2023-05-17 13:28:16 UTC URL https://www.oauth.com/oauth2-servers/accessing-data/authorization-request/ https://www.oauth.com/oauth2-servers/accessing-data/authorization-request/ https://wiki.koha-community.org/wiki/Testing_SSO
nick 2023-05-17 13:28:34 UTC URL https://www.oauth.com/oauth2-servers/accessing-data/authorization-request/ https://wiki.koha-community.org/wiki/Testing_SSO https://www.oauth.com/oauth2-servers/accessing-data/authorization-request/
tomascohen 2023-05-18 14:33:27 UTC See Also https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33768
nick 2023-05-18 18:29:28 UTC Status Signed Off Passed QA
nick 2023-05-18 18:29:30 UTC Attachment #151036 Attachment is obsolete 0 1
nick 2023-05-19 10:30:48 UTC Blocks 33782
tomascohen 2023-05-19 12:21:17 UTC Status Passed QA Pushed to master
Version(s) released in 23.05.00
tomascohen 2023-05-19 12:24:53 UTC Keywords rel_23_05_candidate
Text to go in the release notes This development adds support for the `state` parameter generation and delivery when contacting IdPs. This is an optional but recommended opaque value in the OAuth2/OIDC specs that helps prevent CSRF attacks, but is also a requirement on some Identity Provider solutions.
matt.blenkinsop 2023-06-08 16:58:22 UTC Status Pushed to master Pushed to stable
Version(s) released in 23.05.00 23.05.00,22.11.07
dcook 2023-06-30 02:23:49 UTC Blocks 34163
michaela.sieber 2023-07-28 12:52:23 UTC CC clemens.tubach, lukasz.koszyk, michaela.sieber
katrin.fischer 2023-09-11 13:26:47 UTC Blocks 34755
katrin.fischer 2023-12-28 20:47:27 UTC Status Pushed to stable RESOLVED
Resolution --- FIXED

Back to bug 33675