Bug 36681

Summary: CSRF_TOKEN header should be named CSRF-TOKEN (hyphen instead of underscore)
Product: Koha Reporter: Julian Maurice <julian.maurice>
Component: Architecture, internals, and plumbingAssignee: Bugs List <koha-bugs>
Status: RESOLVED DUPLICATE QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: m.de.rooy
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Julian Maurice 2024-04-24 09:15:24 UTC
By default, nginx ignores invalid headers and header names containing underscores are considered invalid

https://nginx.org/en/docs/http/ngx_http_core_module.html#ignore_invalid_headers
https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers

Changing the underscore to an hyphen would allow to keep the default nginx configuration
Comment 1 Julian Maurice 2024-05-03 06:10:11 UTC

*** This bug has been marked as a duplicate of bug 36700 ***