Summary: | Koha improperly tries to remove foreign cookies on logout (and in general the cookies aren't actually removed, but set to empty values) | ||
---|---|---|---|
Product: | Koha | Reporter: | Michał <schodkowy.omegi-0r> |
Component: | Authentication | Assignee: | Bugs List <koha-bugs> |
Status: | NEW --- | QA Contact: | Testopia <testopia> |
Severity: | minor | ||
Priority: | P5 - low | CC: | dcook, dpavlin, jonathan.druart, m.de.rooy |
Version: | 24.05 | ||
Hardware: | All | ||
OS: | All | ||
See Also: |
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29957 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29956 |
||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: |
Description
Michał
2025-02-26 19:21:29 UTC
That's interesting, Michał! I hadn't bumped into this issue, but I just tried it out on a live site with Google Analytics, and I can see on Koha logout that Koha is taking the GA cookie names and setting new cookies with those GA names for "koha.domain.com.au". Although they're session cookies rather than persistent cookies (as you describe - if I understand what you've said correctly), so they'll be cleared out on a browser restart. But yeah... definitely a bug. -- CCing in Jonathan and Marcel as I think they worked on the original code. From my perspective, I'd say we should only try to manipulate cookies set by Koha, but that would mean keeping an authoritative list somewhere. Koha sets more cookies than just CGISESSID although I don't think they're well documented at the moment... |