Bug 1627 - Separate sessions for OPAC and intranet
Summary: Separate sessions for OPAC and intranet
Status: CLOSED WONTFIX
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P3 enhancement (vote)
Assignee: Galen Charlton
QA Contact: Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-11-27 01:33 UTC by Chris Nighswonger
Modified: 2016-12-05 21:23 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2010-05-21 00:32:46 UTC


---- Reported by cnighswonger@foundations.edu 2007-11-27 13:33:43 ----

When logged into opac as a patron in one window, one cannot log in to the intranet interface as an admin in another window on the same computer.



---- Additional Comments From oleonard@myacpl.org 2007-11-27 15:45:55 ----

I don't find this to be true. Can you describe the procedure you went through to get the error?



---- Additional Comments From cnighswonger@foundations.edu 2007-11-27 17:15:20 ----

1. Create a patron 'jdoe' with password 'jdoe.'

2. Navigate to opac interface and log jdoe in.

3. In a separate browser tab (using Firefox here) navigate to intranet
interface.

4. Note error concerning user not being permited to log into this interface.

Sorry if that seems simplistic. That is what happens on my install. I
have cleared authentications and cookies in Firefox and repeated with
the same results. Maybe something is broke in my install?




---- Additional Comments From oleonard@myacpl.org 2007-11-28 05:35:17 ----

What version of Koha are you using?



---- Additional Comments From chris@bigballofwax.co.nz 2008-01-23 16:24:54 ----

This will happen if you have the same url for both staff and opac interfaces with differing port numbers.
Most browsers store a cookie related to the hostname, they ignore the port.

Do you have port based virtual hosting set up Chris?



---- Additional Comments From cnighswonger@foundations.edu 2008-01-23 16:40:39 ----

Yes. Like:

http://biblios.campus.foundations.edu/

and

http://biblios.campus.foundations.edu:8080/



---- Additional Comments From cnighswonger@foundations.edu 2008-01-23 16:58:17 ----

Moving this to an enhancement as it would be nice to use separate cookies for OPAC and STAFF CLIENT.



--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 00:32 UTC  ---

This bug was previously known as _bug_ 1627 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=1627

Unknown Component Authentication
   Using default product and component set in Parameters 
Unknown operating system Linux - Debian. Setting to default OS "All".
Actual time not defined. Setting to 0.0

Comment 1 Marc Véron 2014-08-11 10:57:41 UTC
Verified:

Koha installation with different port numbers: 
Log in with user one in staff
Log in with user two in OPAC

Result: Login in staff has changed to same user as in OPAC. If user has no staff permissions, Login screen appears.

Koha installation with different URLs:
Log in with user one in staff
Log in with user two in OPAC

Result: Logins are independent
Comment 2 Marc Véron 2015-12-26 07:51:29 UTC
See: 
https://tools.ietf.org/html/rfc6265#section-5.4
"Cookies do not provide isolation by port."

That explains why installations where staff client and OPAC only differ by port number share the same login credentials.

Workarounds with Firefox:

- Open a new private window (it will have it's own cookies). That works great to have a staff user and a 'normal' user in two windows and/or have different language settings. (However, multiple private sessions will share the same cookies.)

- Use a separate profile as described in:
http://kb.mozillazine.org/Opening_a_new_instance_of_Firefox_with_another_profile
Comment 3 Marcel de Rooy 2015-12-27 16:25:08 UTC
Why not close this report?
If you want to have separate sessions, use another ip address or domain name.
People who want to have the shared cookie on the other hand, can use the two ports on the same domain.
Everyone happy ?
Comment 4 Marc Véron 2015-12-27 17:54:07 UTC
+1 to close
Comment 5 Katrin Fischer 2015-12-27 20:08:46 UTC
I think closing this one would be ok - but there is an open issue: because we only have one session, it's not possible to set different time out times - the same pref is used for both staff and OPAC. It could still be desirable to separate the sessions to make this possible.
Comment 6 Marcel de Rooy 2015-12-28 08:38:02 UTC
(In reply to Katrin Fischer from comment #5)
> I think closing this one would be ok - but there is an open issue: because
> we only have one session, it's not possible to set different time out times
> - the same pref is used for both staff and OPAC. It could still be desirable
> to separate the sessions to make this possible.

I opened bug 15428 for this specific enhancement request.
Closing this bug now.