From d644d656e0d91dfe1e02e940c8c3f8e413c386d8 Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Sun, 26 Oct 2025 13:22:59 +0200 Subject: [PATCH] Bug 41104: Catch invalid response header Samesite The SameSite is an attribute to a cookie, not a standard HTTP response header. We can safely remove it. To test: 1. Before applying further patches, 2. prove t/db_dependent/Auth.t 3. Observe test failure --- t/db_dependent/Auth.t | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/t/db_dependent/Auth.t b/t/db_dependent/Auth.t index 502838b91c1..f937c244da8 100755 --- a/t/db_dependent/Auth.t +++ b/t/db_dependent/Auth.t @@ -818,7 +818,7 @@ subtest 'check_cookie_auth' => sub { }; subtest 'checkauth & check_cookie_auth' => sub { - plan tests => 33; + plan tests => 34; # flags = 4 => { catalogue => 1 } my $patron = $builder->build_object( { class => 'Koha::Patrons', value => { flags => 4 } } ); @@ -844,6 +844,8 @@ subtest 'checkauth & check_cookie_auth' => sub { like( $stdout, qr{\s*Log in to your account} ); $sessionID = ( $stdout =~ m{Set-Cookie: CGISESSID=((\d|\w)+);} ) ? $1 : undef; ok($sessionID); + my $sameSite_invalid_header = ( $stdout =~ /(Samesite: Lax)/ ) ? $1 : undef; + is( $sameSite_invalid_header, undef, 'Response does not contain invalid response header Samesite' ); close STDOUT; }; -- 2.34.1