Bug 41104

Summary: Samesite HTTP response header being set in C4::Auth::checkauth()
Product: Koha Reporter: Lari Taskula <lari.taskula>
Component: Architecture, internals, and plumbingAssignee: Lari Taskula <lari.taskula>
Status: Signed Off --- QA Contact: Testopia <testopia>
Severity: trivial    
Priority: P5 - low CC: dcook
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Crowdfunding goal: 0
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on:    
Bug Blocks: 38363    
Attachments: Bug 41104: Catch invalid response header Samesite
Bug 41104: Remove -sameSite from checkauth() response headers
Bug 41104: Remove -sameSite from checkauth() response headers

Description Lari Taskula 2025-10-26 11:38:47 UTC
"SameSite" is an attribute to a cookie. However, in Bug 26019 we have included it in as a HTTP response header for C4::Auth::checkauth(). As it is not a part of standard HTTP response headers, is there more to it, or can it be removed?

https://github.com/Koha-Community/Koha/blob/59ff962caaa28c10ab1a57655ca588359dad367b/C4/Auth.pm#L1427
Comment 1 Lari Taskula 2025-10-26 11:42:05 UTC
Created attachment 188449 [details] [review]
Bug 41104: Catch invalid response header Samesite

The SameSite is an attribute to a cookie, not a standard HTTP response header.

We can safely remove it.

To test:
1. Before applying further patches,
2. prove t/db_dependent/Auth.t
3. Observe test failure
Comment 2 Lari Taskula 2025-10-26 11:42:07 UTC
Created attachment 188450 [details] [review]
Bug 41104: Remove -sameSite from checkauth() response headers

To test:
1. prove t/db_dependent/Auth.t
2. Observe success
Comment 3 Lari Taskula 2025-10-26 14:59:53 UTC
(In reply to Lari Taskula from comment #1)
> Created attachment 188449 [details] [review] [review]
> Bug 41104: Catch invalid response header Samesite
I'm not sure this test needs to be pushed. It does not really serve any purpose in the long run, after the second patch is pushed.
Comment 4 David Cook 2025-10-26 22:45:29 UTC
(In reply to Lari Taskula from comment #3)
> (In reply to Lari Taskula from comment #1)
> > Created attachment 188449 [details] [review] [review] [review]
> > Bug 41104: Catch invalid response header Samesite
> I'm not sure this test needs to be pushed. It does not really serve any
> purpose in the long run, after the second patch is pushed.

Yeah, I don't think it's really necessary either.
Comment 5 David Cook 2025-10-26 22:46:17 UTC
Comment on attachment 188449 [details] [review]
Bug 41104: Catch invalid response header Samesite

I'm going to mark it as obsolete for now, because I don't think the test adds too much value for the future.
Comment 6 David Cook 2025-10-26 22:48:34 UTC
Created attachment 188452 [details] [review]
Bug 41104: Remove -sameSite from checkauth() response headers

To test:
1. prove t/db_dependent/Auth.t
2. Observe success

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 7 David Cook 2025-10-26 22:49:45 UTC
Good catch on this one. What a little oopsie. 

Super easy to test in the browser by using the F12 tools and just checking for the presence of that SameSite HTTP header on the response from the server on the load of any page. 

The header is there before the patch, and the header is not there after the patch.