Summary: | Koha errors on page (e.g. 404) cause incorrect CSRF errors | ||
---|---|---|---|
Product: | Koha | Reporter: | David Cook <dcook> |
Component: | Architecture, internals, and plumbing | Assignee: | David Cook <dcook> |
Status: | RESOLVED FIXED | QA Contact: | Chris Cormack <chris> |
Severity: | critical | ||
Priority: | P5 - low | CC: | david, fridolin.somers, lucas |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: |
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35402 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37056 |
||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: |
This change prevents an error in a background call (e.g. a missing favicon.ico) from affecting the user's session, which can lead to incorrect CSRF 403 errors during form POSTs. (The issue is prevented by stopping error pages from returning the CGISESSID cookie, which overwrites the CGISESSID cookie returned by the foreground page.)
|
Version(s) released in: |
24.11.00,24.05.06
|
Circulation function: | |||
Bug Depends on: | 36192 | ||
Bug Blocks: | |||
Attachments: |
Bug 37741: Do not send cookie back from error pages
Bug 37741: Do not send cookie back from error pages Bug 37741: Do not send cookie back from error pages |
Description
David Cook
2024-08-27 01:38:50 UTC
I actually first noticed this problem after bug 35402 was pushed. It was crazymaking, but I noticed a 404 in the plack.log, and then I turned on the Apache access log, and realized it was a 404 for http://localhost:8081/intranet-tmpl/lib/bootstrap/bootstrap.bundle.min.js.map. It wasn't showing up in the Network tab, but if you go into "Sources" and look at the /intranet-tmpl/lib/bootstrap/bootstrap.bundle.min.js, you'll see at the bottom of the screen a message "Source map failed to load" and it mentions the 404 for the map file. Note: the browser only tries to load the map file when you have your dev tools open. So login won't work if you have your dev tools open, but it will if they're closed. Fun! This problem really was first noticed by Nick on bug 37056, although the solution there was to fix the SVC API, which makes sense for that particular bug. But it's the same idea under the hood. The problem is that the CGISESSID cookie gets overridden by a background call which messes up the foreground. Created attachment 170743 [details] [review] Bug 37741: Do not send cookie back from error pages This change stops the cookie from being sent back from error pages, so that backcalls that cause errors don't overwrite the existing cookie used by the foreground request page. Test plan: 0. Apply the patch and koha-plack --reload kohadev 1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg 2. Open browser developer tools 3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl 4. Open the Network tab, disable the cache, and shift refresh 5. Notice that bad.jpg fails to load with a 404 6. Try to login to Koha 7. Confirm login works *. Extra points if you note that the cookie returned by the first mainpage.pl request is used for the bad.jpg lookup and the second mainpage.pl request. Created attachment 170794 [details] [review] Bug 37741: Do not send cookie back from error pages This change stops the cookie from being sent back from error pages, so that backcalls that cause errors don't overwrite the existing cookie used by the foreground request page. Test plan: 0. Apply the patch and koha-plack --reload kohadev 1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg 2. Open browser developer tools 3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl 4. Open the Network tab, disable the cache, and shift refresh 5. Notice that bad.jpg fails to load with a 404 6. Try to login to Koha 7. Confirm login works *. Extra points if you note that the cookie returned by the first mainpage.pl request is used for the bad.jpg lookup and the second mainpage.pl request. Signed-off-by: David Nind <david@davidnind.com> I didn't go for the extra points! 8-) Tested in Firefox and Google Chrome on Ubuntu 22.04 (weird things were happening with Chromium...). I attempted a release note - I hope I have captured the essential parts so that it makes sense to library staff. It may be useful to add an example. Thanks, David. I'll revise the release note. Thanks for adding it! Created attachment 170897 [details] [review] Bug 37741: Do not send cookie back from error pages This change stops the cookie from being sent back from error pages, so that backcalls that cause errors don't overwrite the existing cookie used by the foreground request page. Test plan: 0. Apply the patch and koha-plack --reload kohadev 1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg 2. Open browser developer tools 3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl 4. Open the Network tab, disable the cache, and shift refresh 5. Notice that bad.jpg fails to load with a 404 6. Try to login to Koha 7. Confirm login works *. Extra points if you note that the cookie returned by the first mainpage.pl request is used for the bad.jpg lookup and the second mainpage.pl request. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz> Pushed for 24.11! Well done everyone, thank you! Backported to 24.05.x for upcoming 24.05.06 Not for 23.11.x This fixes an error, and no changes are required to the manual. |