| Summary: | OPAC and staff (intranet) should not share the same session and cookie | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Marcel de Rooy <m.de.rooy> |
| Component: | Authentication | Assignee: | Bugs List <koha-bugs> |
| Status: | NEW --- | QA Contact: | Testopia <testopia> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | cslone, dcook, dpavlin, jonathan.druart, martin.renvoize |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=32369 | ||
| Change sponsored?: | --- | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
|
Description
Marcel de Rooy
2022-12-01 07:27:37 UTC
I think in a way this is a requirement for the older bug 15428. When we have different sessions, we can also implement different timeouts if I am not mistaken. Something else to keep in mind is cookie authentication for the REST API interface via the staff interface and OPAC. Maybe this is an opportunity to switch away from "CGISESSID" to more Koha-specific cookie names. There are over 200 references to CGISESSID in the code, although to lessen the work we could just change the cookie name for the OPAC. That would involve fewer script changes. Auth.pm would need an update at a minimum though. If someone is willing to do the work, I suppose there's no reason not to... |