From 0b7c1ea1faf8358d328a9fa72aa7e7d0716a60df Mon Sep 17 00:00:00 2001 From: David Cook Date: Fri, 26 Sep 2025 02:24:29 +0000 Subject: [PATCH] Bug 40736: Gracefully handle missing CGISESSID cookie This change makes the REST API gracefully handle a missing CGISESSID when trying to do an OAuth/OIDC login by direct linking. Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Set up an OpenID Connect client using the wiki https://wiki.koha-community.org/wiki/Testing_SSO 2. In an incognito/private window, try directly logging in with the following URL: http://localhost:8080/api/v1/public/oauth/login/test/opac 3. Note that you're redirected to opac-user.pl with an auth error message of "No user session found" 4. Close the incognito/private window 5. In an incognito/private window, try directly logging in with the following URL: http://localhost:8081/api/v1/oauth/login/test/staff 6. Note that you're redirected to mainpage.pl with an auth error message of "No user session found" --- Koha/REST/V1/OAuth/Client.pm | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Koha/REST/V1/OAuth/Client.pm b/Koha/REST/V1/OAuth/Client.pm index e724b20f3b..8805eeb43b 100644 --- a/Koha/REST/V1/OAuth/Client.pm +++ b/Koha/REST/V1/OAuth/Client.pm @@ -68,6 +68,11 @@ sub login { return $c->redirect_to( $uri . "?auth_error=$error" ); } + if ( !$c->req->cookie('CGISESSID') ) { + my $error = "No user session found"; + return $c->redirect_to( $uri . "?auth_error=$error" ); + } + unless ( $provider_config->{authorize_url} =~ /response_type=code/ ) { my $authorize_url = Mojo::URL->new( $provider_config->{authorize_url} ); $authorize_url->query->append( response_type => 'code' ); -- 2.39.5