There is code in C4/Auth to kickout the self check users if they leave the module. This works, however, the session is not cleared. This means that if a patron were using the SCO, then navigated to the OPAC they would have to sign in to view their account, and they might assume their info was cleared, however, returning to the SCO will re-enter the user session To test: 1 - Setup self_check user 2 - Open sco module 3 - Sign in a patron 4 - Checkout an item 5 - Browse to the opac 6 - You are not logged in 7 - Return to SCO 8 - User account is still signed in
This was discovered in testing bug 23105 - previously the user session would be ended and require a login. Now this no longer happens
bug 23102 that is
When you say "setup self_check user", do you mean a "AutoSelfCheck" user? That's the user that has the session for the SCO initially. When a human user then provides a cardnumber or login, they're not really logged in. They're just authenticating that they're that person. When they browse to the OPAC, the CGISESSID cookie for the "AutoSelfCheck" session is cleared, so that the human user isn't hijacking the "AutoSelfCheck" session. -- What do you mean by "Return to SCO"? Is that using the "Back" button, or is it by clicking a link, or something else? Looking at the kick_out code, we probably should be deleting the SCO session and not just sending back an empty cookie. There might be scenarios where the browser is hanging on to the cookie that contains the session ID and that's what you're seeing. But need a bit more information to confirm I reckon.
(In reply to David Cook from comment #3) > When you say "setup self_check user", do you mean a "AutoSelfCheck" user? > That's the user that has the session for the SCO initially. Yes, the AutoSelfCheck > > When a human user then provides a cardnumber or login, they're not really > logged in. They're just authenticating that they're that person. > > When they browse to the OPAC, the CGISESSID cookie for the "AutoSelfCheck" > session is cleared, so that the human user isn't hijacking the > "AutoSelfCheck" session. Correct - the user is not logged in as themself or the AutoSelfCheck user when they leave the SCO > What do you mean by "Return to SCO"? Is that using the "Back" button, or is > it by clicking a link, or something else? I tested by entering the URL manually: I left by entering search url manually: http://localhost:8080/cgi-bin/koha/opac-search.pl?idx=&q=a&weight_search=1 And returned entering the SCO url manually: http://localhost:8080/cgi-bin/koha/sco/sco-main.pl > > Looking at the kick_out code, we probably should be deleting the SCO session > and not just sending back an empty cookie. There might be scenarios where > the browser is hanging on to the cookie that contains the session ID and > that's what you're seeing. Agreed > > But need a bit more information to confirm I reckon. Let me know if this is more clear now
(In reply to Nick Clemens from comment #4) > Let me know if this is more clear now I think so. I have a couple of things I need to do, but I'll try to get back to this today.
Ok so the issue isn't the cookie or the session. It's the JWT header. That is being persisted and it contains {"id": "<cardnumber>"}. That's why it's going back in.
(In reply to David Cook from comment #6) > Ok so the issue isn't the cookie or the session. It's the JWT header. That > is being persisted and it contains {"id": "<cardnumber>"}. > > That's why it's going back in. Sorry my bad. Not JWT header. JWT cookie (as distinct from the CGISESSID cookie which our authentication cookie for the self check user).
(In reply to David Cook from comment #7) > Sorry my bad. Not JWT header. JWT cookie (as distinct from the CGISESSID > cookie which our authentication cookie for the self check user). Actually, I haven't checked the CGISESSID in this context. But we don't need to worry about that right now. Basically we need to make sure the JWT gets cleared on kick out and not just log out.
(In reply to David Cook from comment #8) > Basically we need to make sure the JWT gets cleared on kick out and not just > log out. This will be ugly since the generic cookie name of "JWT" was used instead of something like "SC_JWT", but... it should be safe enough...
Created attachment 152029 [details] [review] Bug 33881: Clear self-check JWT during auth kick out This patch clears the JWT cookie during auth kick out (ie when a web user navigates from the self-check out/in to the rest of Koha). Test plan: 0. Apply patch and koha-plack --reload kohadev 1. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 2. Log in as the "koha" user 3. In another tab, go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 4. Go to http://localhost:8080/cgi-bin/koha/opac-search.pl?idx=&q=a&weight_search=1 5. Note that you are prompted to "Log in to your account" via the normal Koha prompt 6. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 7. Note that you are prompted to "Log in to your account" within the "Self checkout system", and note that your self-checkout session for the "koha" user has *not* persisted like it did before the patch was applied
Created attachment 153209 [details] [review] Bug 33881: Clear self-check JWT during auth kick out This patch clears the JWT cookie during auth kick out (ie when a web user navigates from the self-check out/in to the rest of Koha). Test plan: 0. Apply patch and koha-plack --reload kohadev 1. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 2. Log in as the "koha" user 3. In another tab, go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 4. Go to http://localhost:8080/cgi-bin/koha/opac-search.pl?idx=&q=a&weight_search=1 5. Note that you are prompted to "Log in to your account" via the normal Koha prompt 6. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 7. Note that you are prompted to "Log in to your account" within the "Self checkout system", and note that your self-checkout session for the "koha" user has *not* persisted like it did before the patch was applied Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org>
Created attachment 153312 [details] [review] Bug 33881: Clear self-check JWT during auth kick out This patch clears the JWT cookie during auth kick out (ie when a web user navigates from the self-check out/in to the rest of Koha). Test plan: 0. Apply patch and koha-plack --reload kohadev 1. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 2. Log in as the "koha" user 3. In another tab, go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 4. Go to http://localhost:8080/cgi-bin/koha/opac-search.pl?idx=&q=a&weight_search=1 5. Note that you are prompted to "Log in to your account" via the normal Koha prompt 6. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 7. Note that you are prompted to "Log in to your account" within the "Self checkout system", and note that your self-checkout session for the "koha" user has *not* persisted like it did before the patch was applied Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
This patch doesn't apply cleanly for 21.11.x could somebody please rebase it.
(In reply to Danyon Sewell from comment #13) > This patch doesn't apply cleanly for 21.11.x could somebody please rebase it. This one hasn't been pushed to master yet. Are you updating the correct bug report?
(In reply to David Cook from comment #14) > (In reply to Danyon Sewell from comment #13) > > This patch doesn't apply cleanly for 21.11.x could somebody please rebase it. > > This one hasn't been pushed to master yet. Are you updating the correct bug > report? Hi David. I'm the release maintainer for 21.11.x and am in the process of backporting all of the required security patches in time for the release. This is one of those patches.
(In reply to Danyon Sewell from comment #15) > Hi David. > > I'm the release maintainer for 21.11.x and am in the process of backporting > all of the required security patches in time for the release. > > This is one of those patches. I'm guessing the RM/RMaints must be discussing outside Bugzilla. Looking at other Koha security patches, it looks like sometimes the RM will say pushed to master and sometimes not... bug 33595 and bug 32208 I'll put it back to "Patch doesn't apply". Resetting assignee as someone else can take it over. I probably won't get a chance to work on this for a while.
Created attachment 153750 [details] [review] Bug 33881: [21.11] Clear self-check JWT during auth kick out This patch clears the JWT cookie during auth kick out (ie when a web user navigates from the self-check out/in to the rest of Koha). Test plan: 0. Apply patch and koha-plack --reload kohadev 1. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 2. Log in as the "koha" user 3. In another tab, go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 4. Go to http://localhost:8080/cgi-bin/koha/opac-search.pl?idx=&q=a&weight_search=1 5. Note that you are prompted to "Log in to your account" via the normal Koha prompt 6. Go to http://localhost:8080/cgi-bin/koha/sco/sco-main.pl 7. Note that you are prompted to "Log in to your account" within the "Self checkout system", and note that your self-checkout session for the "koha" user has *not* persisted like it did before the patch was applied Signed-off-by: Andrew Fuerste-Henry <andrewfh@dubcolib.org> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Here is a rebase version for 21.11. I have not tested it though.
(In reply to David Cook from comment #16) > Resetting assignee as someone else can take it over. I probably won't get a > chance to work on this for a while. It took me 30sec.
(In reply to Jonathan Druart from comment #19) > (In reply to David Cook from comment #16) > > Resetting assignee as someone else can take it over. I probably won't get a > > chance to work on this for a while. > > It took me 30sec. I'll buy you a beer in Montreal next year. (In reply to Jonathan Druart from comment #18) > Here is a rebase version for 21.11. I have not tested it though. The testing part seemed daunting, especially as my mind is on other things for other versions at the moment. I think perhaps I do not understand the security release procedure well enough as well.
Should this still be patch doesn't apply?
(In reply to Katrin Fischer from comment #21) > Should this still be patch doesn't apply? I don't think so. I think it would be OK to put back to "Passed QA"?
Pushed to master for 23.11. Nice work everyone, thanks!
Pushed to 23.05.x for 23.05.02
I think this was not added in time for the v22.11.08 tag release but it's included in 22.11.09.
This needs a 22.05.x rebase, if possible.