From 8df8cbb51cb306aadb4c64d0324dd34047de47f4 Mon Sep 17 00:00:00 2001 From: Maryse Simard Date: Mon, 5 Feb 2024 20:34:17 -0500 Subject: [PATCH] Bug 34755: Resets the userenv when calling OAuth api endpoints When using OIDC authentication, the error "wrong_csrf_token" can happen if another user's userenv is loaded during login. This is because the wrong userenv is used to compare the tokens. This patch explicitly resets userenv when using OAuth endpoints of the Koha api. Steps to reproduce: 0. On a Koha with SSO configured 1. Open the OPAC 2. Log in with a regular Koha user, not using SSO. 3. In a private browser window, open the OPAC 4. log in using SSO with a different user account. 5. Notice that you get the error message "There was an error authenticating to external identity provider wrong_csrf_token" 6. Click on the "Log in with [...]" button again. 7. Notice that the user is immediately logged in. To test: - Apply the tests patch - prove t/db_dependent/api/v1/idp.t => FAIL: wrong_csrf_token - Apply patch - prove t/db_dependent/api/v1/idp.t => SUCCESS - Run other OAuth endpoints tests to make sure nothing broke: prove t/db_dependent/api/v1/auth_authenticate_api_request.t prove t/db_dependent/api/v1/oauth.t --- Koha/REST/V1/Auth.pm | 1 + 1 file changed, 1 insertion(+) diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm index 948bed689b..5ef64da0d6 100644 --- a/Koha/REST/V1/Auth.pm +++ b/Koha/REST/V1/Auth.pm @@ -84,6 +84,7 @@ sub under { if ( $c->req->url->to_abs->path =~ m#^/api/v1/oauth/# || $c->req->url->to_abs->path =~ m#^/api/v1/public/oauth/#) { # Requesting OAuth endpoints shouldn't go through the API authentication chain + C4::Context->set_userenv( undef, q{} ); $status = 1; } elsif ( $namespace eq '' or $namespace eq '.html' ) { -- 2.34.1