| Summary: | Samesite HTTP response header being set in C4::Auth::checkauth() | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Lari Taskula <lari.taskula> |
| Component: | Architecture, internals, and plumbing | Assignee: | Lari Taskula <lari.taskula> |
| Status: | Signed Off --- | QA Contact: | Testopia <testopia> |
| Severity: | trivial | ||
| Priority: | P5 - low | CC: | dcook |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Crowdfunding goal: | 0 |
| Patch complexity: | --- | Documentation contact: | |
| Documentation submission: | Text to go in the release notes: | ||
| Version(s) released in: | Circulation function: | ||
| Bug Depends on: | |||
| Bug Blocks: | 38363 | ||
| Attachments: |
Bug 41104: Catch invalid response header Samesite
Bug 41104: Remove -sameSite from checkauth() response headers Bug 41104: Remove -sameSite from checkauth() response headers |
||
|
Description
Lari Taskula
2025-10-26 11:38:47 UTC
Created attachment 188449 [details] [review] Bug 41104: Catch invalid response header Samesite The SameSite is an attribute to a cookie, not a standard HTTP response header. We can safely remove it. To test: 1. Before applying further patches, 2. prove t/db_dependent/Auth.t 3. Observe test failure Created attachment 188450 [details] [review] Bug 41104: Remove -sameSite from checkauth() response headers To test: 1. prove t/db_dependent/Auth.t 2. Observe success (In reply to Lari Taskula from comment #1) > Created attachment 188449 [details] [review] [review] > Bug 41104: Catch invalid response header Samesite I'm not sure this test needs to be pushed. It does not really serve any purpose in the long run, after the second patch is pushed. (In reply to Lari Taskula from comment #3) > (In reply to Lari Taskula from comment #1) > > Created attachment 188449 [details] [review] [review] [review] > > Bug 41104: Catch invalid response header Samesite > I'm not sure this test needs to be pushed. It does not really serve any > purpose in the long run, after the second patch is pushed. Yeah, I don't think it's really necessary either. Comment on attachment 188449 [details] [review] Bug 41104: Catch invalid response header Samesite I'm going to mark it as obsolete for now, because I don't think the test adds too much value for the future. Created attachment 188452 [details] [review] Bug 41104: Remove -sameSite from checkauth() response headers To test: 1. prove t/db_dependent/Auth.t 2. Observe success Signed-off-by: David Cook <dcook@prosentient.com.au> Good catch on this one. What a little oopsie. Super easy to test in the browser by using the F12 tools and just checking for the presence of that SameSite HTTP header on the response from the server on the load of any page. The header is there before the patch, and the header is not there after the patch. |