When using the ILS-DI "AuthenticatePatron" service, you'll want to POST to the ILS-DI, but now this isn't possible without a CSRF token. But a third-party system doesn't have a CSRF token. This relates to bug 36094. It also won't have an "op" with a "cud-" prefix.
As I describe in https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36094#c23 I think we'll actually have to have a ILS-DI exception for CSRF checking, since it uses IP-based auth and not cookie-based auth.
Note that some ILS-DI services are state changing actions. I will be glad when this ILS-DI API is gone...
Arf this is a problem for Bokeh portal
*** Bug 37899 has been marked as a duplicate of this bug. ***
I am hoping to get to this soon. Thanks for your patience, folks...
Created attachment 173114 [details] [review] Bug 36560: Add a CSRF exception for ILS-DI API This change adds an exception for the ILS-DI API for CSRF prevention since there is no way to acquire a CSRF token for the ILS-DI API. 1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=ILS-DI 2. Enable "ILS-DI" 3. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD" 4. Note the 403 response 5. Apply the patch 6. sudo koha-plack --restart kohadev 7. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD" 8. Note the 200 response
Technically, the ILS-DI API can be vulnerable to CSRF, if the ILS-DI:AuthorizedIPs is blank or if it matches the IP address of the targeted user. However, the ILS-DI API doesn't have any way of obtaining a CSRF token, so I think we should add an exception. Alternatively, we could change the way the ILS-DI API works, but that would have far reaching consequences. Another alternative would be to replicate all ILS-DI API functionality in the REST API, and switch people over to using that...
Yet... as practical as an exception might be in the short-term... it still doesn't help us in the long-term. -- Maybe we do make an AuthenticateApiUser verb for the ILS-DI too, which requires a Koha staff user with an ILS-DI permission, and then we get all third-parties to use that. Initially, if we add a CSRF exception, we could continue supporting ILS-DI:AuthorizedIPs as well, and then eventually remove the exception and drop IP auth support. -- Jonathan, what do you think? The ILS-DI API is used fairly broadly. Not only for discovery systems like VuFind and EBSCO EDS but also for other third-party systems (especially in public libraries) that use it to authenticate patrons. Overall, I've found third-parties willing to work with us on API integrations, but Koha hasn't had the options for secure HTTP API integrations (even the REST API has permissions issues to an extent).
(In reply to David Cook from comment #8) > Jonathan, what do you think? Not ideal but I don't have something better to suggest.
Created attachment 173182 [details] [review] Bug 36560: Add a CSRF exception for ILS-DI API This change adds an exception for the ILS-DI API for CSRF prevention since there is no way to acquire a CSRF token for the ILS-DI API. 1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=ILS-DI 2. Enable "ILS-DI" 3. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD" 4. Note the 403 response 5. Apply the patch 6. sudo koha-plack --restart kohadev 7. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD" 8. Note the 200 response Signed-off-by: David Nind <david@davidnind.com>
Created attachment 173349 [details] [review] Bug 36560: Add a CSRF exception for ILS-DI API This change adds an exception for the ILS-DI API for CSRF prevention since there is no way to acquire a CSRF token for the ILS-DI API. 1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=ILS-DI 2. Enable "ILS-DI" 3. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD" 4. Note the 403 response 5. Apply the patch 6. sudo koha-plack --restart kohadev 7. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD" 8. Note the 200 response Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 173350 [details] [review] Bug 36560: (QA follow-up) Tidy code Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Might be good to have a quick note here that this means the ILS-DI service will work again.
Pushed for 24.11! Well done everyone, thank you!
Backported to 24.05.x for upcoming 24.05.06