Bug 40736

Summary: OAuth/OIDC authentication broken when CGISESSID is missing
Product: Koha Reporter: Lari Taskula <lari.taskula>
Component: REST APIAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: tomascohen
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 33675    
Bug Blocks:    

Description Lari Taskula 2025-09-01 10:45:06 UTC
Our API error logs contain multiple instances of the following error

> [ERROR] Can't call method "value" on an undefined value at /usr/share/koha/lib/Koha/REST/V1/OAuth/Client.pm line 100.

Client.pm:100 is

>         $state = Koha::Token->new->generate_csrf( { session_id => $c->req->cookie('CGISESSID')->value } );

This happens when a web crawler (Googlebot in our case) navigates to OAuth/OIDC login API endpoint, and Koha attempts to generate them a new CSRF token but is unable to due to missing CGISESSID cookie.

To replicate:
1. Have an identity provider <provider code> defined under Administration > Identity providers
2. On a fresh browser session (clear cookies),
3. Navigate to https://yourkoha/api/v1/public/oauth/login/<provider code>/opac
4. Observe [ERROR] Can't call method "value" on an undefined value at /usr/share/koha/lib/Koha/REST/V1/OAuth/Client.pm line 100. in plack-api-error.log