Bug 32385 - OPAC and staff (intranet) should not share the same session and cookie
Summary: OPAC and staff (intranet) should not share the same session and cookie
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-12-01 07:27 UTC by Marcel de Rooy
Modified: 2023-04-23 23:27 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2022-12-01 07:27:37 UTC 
See also bug 32369. A login via OPAC should imo not allow you to access staff too when you share the same domain (and cookies) between them.
Comment 1 Katrin Fischer 2023-04-23 15:58:38 UTC 
I think in a way this is a requirement for the older bug 15428. When we have different sessions, we can also implement different timeouts if I am not mistaken.
Comment 2 David Cook 2023-04-23 23:27:57 UTC 
Something else to keep in mind is cookie authentication for the REST API interface via the staff interface and OPAC. 

Maybe this is an opportunity to switch away from "CGISESSID" to more Koha-specific cookie names. 

There are over 200 references to CGISESSID in the code, although to lessen the work we could just change the cookie name for the OPAC. That would involve fewer script changes. Auth.pm would need an update at a minimum though.

If someone is willing to do the work, I suppose there's no reason not to...