Bug 36564

Summary: Koha staff interface logs out on homepage refresh with 2FA enforced
Product: Koha Reporter: Chris Rowlands <chris.rowlands6>
Component: Staff interfaceAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: trivial    
Priority: P5 - low CC: david, gmcharlt
Version: 22.11   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 20476    
Bug Blocks:    

Description Chris Rowlands 2024-04-10 08:02:44 UTC
Koha will log the staff user out if they refresh the homepage and confirm form resubmission after logging in with 2FA enforced.

To reproduce:

1) ensure TwoFactorAuthentication is set to "Enforce"
2) log into staff interface including two factor code
3) refresh the homepage and confirm dialogue box for confirm form resubmission

This logs you out. However if you navigate to another page and back a refresh functions normally; also if you don't have 2FA enabled a refresh functions normally.

I've not submitted a bug before so please let me know if I've submitted this poorly/incorrectly.