Bug 42066

Summary: CSRF-token sometimes missing from pages
Product: Koha Reporter: Magnus Enger <magnus>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low    
Version: Main   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Crowdfunding committed: 0
Crowdfunding contact: Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Magnus Enger 2026-03-11 08:20:54 UTC
To reproduce in KTD: 

- In your console, keep an eye on the logs: 
  $ sudo tail -f /var/log/koha/kohadev/plack*.log
- Open the SCO main page (http://localhost:8080/cgi-bin/koha/sco/sco-main.pl) in your browser, but do not do anything there
- Remove the path from the URL, in the address bar of your browser, so you just have http://localhost:8080/, and press enter
- Use Ctrl+u or "developer tools" to view the source of the front page, search for "csrf" and verify the elements that should contain the csrf token are empty: 
  <meta name="csrf-token" content="" />
  <input type="hidden" name="csrf_token" value="" />
- Log in an verify you get an error like this: 
  Error 403
  This message can have the following reason(s):
  An unexpected error occurred while processing your request.
- Check the logs and verify you have an error like this: 
  ==> /var/log/koha/kohadev/plack-opac-error.log <==
  [2026/03/11 08:12:41] [WARN] Programming error - No CSRF token passed for POST http://localhost:8080/opac/opac-main.pl (referer: http://localhost:8080/) at /kohadevbox/koha/Koha/Middleware/CSRF.pm line 97.

Moving from SCO to the main page like this is probably not something that happens too often, but perhaps there is some underlying problem that can also affect other parts of Koha?
Comment 1 Magnus Enger 2026-03-11 08:24:35 UTC
Hm, another weird thing: 

- Paste http://localhost:8080/cgi-bin/koha/sco/sco-main.pl into your address bar and press Enter
- Edit the URL so you just have http://localhost:8080/ and press Enter
- This presents the "Log in to your account" page
- Do not edit the URL again, but click on it and press Enter again
- This time the front page of the OPAC is displayed