Bugzilla – Attachment 192580 Details for
Bug 40736
OAuth/OIDC authentication logs error message when CGISESSID is missing
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 40736: Gracefully handle missing CGISESSID cookie
Bug-40736-Gracefully-handle-missing-CGISESSID-cook.patch (text/plain), 1.86 KB, created by
David Cook
on 2026-02-06 06:16:16 UTC
(
hide
)
Description:
Bug 40736: Gracefully handle missing CGISESSID cookie
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-02-06 06:16:16 UTC
Size:
1.86 KB
patch
obsolete
>From 93a2fb4bb03d054429e535c4a8d2173e95075cc4 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Fri, 26 Sep 2025 02:24:29 +0000 >Subject: [PATCH] Bug 40736: Gracefully handle missing CGISESSID cookie > >This change makes the REST API gracefully handle >a missing CGISESSID when trying to do an OAuth/OIDC login >by direct linking. > >Test plan: >0. Apply the patch and koha-plack --restart kohadev >1. Set up an OpenID Connect client using the wiki >https://wiki.koha-community.org/wiki/Testing_SSO >2. In an incognito/private window, try directly logging in >with the following URL: >http://localhost:8080/api/v1/public/oauth/login/test/opac >3. Note that you're redirected to opac-user.pl with an auth error >message of "No user session found" >4. Close the incognito/private window >5. In an incognito/private window, try directly logging in >with the following URL: >http://localhost:8081/api/v1/oauth/login/test/staff >6. Note that you're redirected to mainpage.pl with an auth error >message of "No user session found" > >Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi> >Signed-off-by: David Cook <dcook@prosentient.com.au> >--- > Koha/REST/V1/OAuth/Client.pm | 5 +++++ > 1 file changed, 5 insertions(+) > >diff --git a/Koha/REST/V1/OAuth/Client.pm b/Koha/REST/V1/OAuth/Client.pm >index 3b5ea677d3a..08dcc26f779 100644 >--- a/Koha/REST/V1/OAuth/Client.pm >+++ b/Koha/REST/V1/OAuth/Client.pm >@@ -77,6 +77,11 @@ sub login { > return $c->redirect_to( $uri . "?auth_error=$error" ); > } > >+ if ( !$c->req->cookie('CGISESSID') ) { >+ my $error = "No user session found"; >+ return $c->redirect_to( $uri . "?auth_error=$error" ); >+ } >+ > unless ( $provider_config->{authorize_url} =~ /response_type=code/ ) { > my $authorize_url = Mojo::URL->new( $provider_config->{authorize_url} ); > $authorize_url->query->append( response_type => 'code' ); >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 40736
:
186651
|
186950
|
187031
|
187032
|
187033
| 192580 |
192581
|
192582