Bug 36560 - ILS-DI API POSTS cause CSRF errors
Summary: ILS-DI API POSTS cause CSRF errors
Status: Pushed to stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Web services (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: David Cook
QA Contact: Kyle M Hall (khall)
URL:
Keywords:
: 37899 (view as bug list)
Depends on:
Blocks:
 
Reported: 2024-04-10 02:39 UTC by David Cook
Modified: 2024-11-20 23:32 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
This change creates an anti-CSRF exception so that the ILS-DI API will work without a CSRF token. Libraries are reminded that they should be careful when configuring the ILS-DI:AuthorizedIPs system preference for access to the ILS-DI API.
Version(s) released in:
24.11.00,24.05.06
Circulation function:


Attachments
Bug 36560: Add a CSRF exception for ILS-DI API (1.73 KB, patch)
2024-10-22 02:11 UTC, David Cook
Details | Diff | Splinter Review
Bug 36560: Add a CSRF exception for ILS-DI API (1.78 KB, patch)
2024-10-22 19:55 UTC, David Nind
Details | Diff | Splinter Review
Bug 36560: Add a CSRF exception for ILS-DI API (1.85 KB, patch)
2024-10-25 11:50 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 36560: (QA follow-up) Tidy code (1.22 KB, patch)
2024-10-25 11:50 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2024-04-10 02:39:43 UTC
When using the ILS-DI "AuthenticatePatron" service, you'll want to POST to the ILS-DI, but now this isn't possible without a CSRF token.

But a third-party system doesn't have a CSRF token. This relates to bug 36094.

It also won't have an "op" with a "cud-" prefix.
Comment 1 David Cook 2024-04-10 02:53:38 UTC
As I describe in https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36094#c23 I think we'll actually have to have a ILS-DI exception for CSRF checking, since it uses IP-based auth and not cookie-based auth.
Comment 2 David Cook 2024-04-10 03:41:11 UTC
Note that some ILS-DI services are state changing actions. 

I will be glad when this ILS-DI API is gone...
Comment 3 Fridolin Somers 2024-09-12 10:31:16 UTC
Arf this is a problem for Bokeh portal
Comment 4 David Cook 2024-09-24 17:52:45 UTC
*** Bug 37899 has been marked as a duplicate of this bug. ***
Comment 5 David Cook 2024-10-21 23:50:29 UTC
I am hoping to get to this soon. Thanks for your patience, folks...
Comment 6 David Cook 2024-10-22 02:11:23 UTC
Created attachment 173114 [details] [review]
Bug 36560: Add a CSRF exception for ILS-DI API

This change adds an exception for the ILS-DI API for CSRF prevention since there is no way to acquire a CSRF token
for the ILS-DI API.

1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=ILS-DI
2. Enable "ILS-DI"
3. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD"
4. Note the 403 response

5. Apply the patch
6. sudo koha-plack --restart kohadev

7. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD"
8. Note the 200 response
Comment 7 David Cook 2024-10-22 02:15:06 UTC
Technically, the ILS-DI API can be vulnerable to CSRF, if the ILS-DI:AuthorizedIPs is blank or if it matches the IP address of the targeted user.

However, the ILS-DI API doesn't have any way of obtaining a CSRF token, so I think we should add an exception.

Alternatively, we could change the way the ILS-DI API works, but that would have far reaching consequences. 

Another alternative would be to replicate all ILS-DI API functionality in the REST API, and switch people over to using that...
Comment 8 David Cook 2024-10-22 02:32:32 UTC
Yet... as practical as an exception might be in the short-term... it still doesn't help us in the long-term.

--

Maybe we do make an AuthenticateApiUser verb for the ILS-DI too, which requires a Koha staff user with an ILS-DI permission, and then we get all third-parties to use that. 

Initially, if we add a CSRF exception, we could continue supporting ILS-DI:AuthorizedIPs as well, and then eventually remove the exception and drop IP auth support. 

--

Jonathan, what do you think? 

The ILS-DI API is used fairly broadly. Not only for discovery systems like VuFind and EBSCO EDS but also for other third-party systems (especially in public libraries) that use it to authenticate patrons.

Overall, I've found third-parties willing to work with us on API integrations, but Koha hasn't had the options for secure HTTP API integrations (even the REST API has permissions issues to an extent).
Comment 9 Jonathan Druart 2024-10-22 07:35:02 UTC
(In reply to David Cook from comment #8)
> Jonathan, what do you think? 

Not ideal but I don't have something better to suggest.
Comment 10 David Nind 2024-10-22 19:55:26 UTC
Created attachment 173182 [details] [review]
Bug 36560: Add a CSRF exception for ILS-DI API

This change adds an exception for the ILS-DI API for CSRF prevention since there is no way to acquire a CSRF token
for the ILS-DI API.

1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=ILS-DI
2. Enable "ILS-DI"
3. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD"
4. Note the 403 response

5. Apply the patch
6. sudo koha-plack --restart kohadev

7. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD"
8. Note the 200 response

Signed-off-by: David Nind <david@davidnind.com>
Comment 11 Kyle M Hall (khall) 2024-10-25 11:50:31 UTC
Created attachment 173349 [details] [review]
Bug 36560: Add a CSRF exception for ILS-DI API

This change adds an exception for the ILS-DI API for CSRF prevention since there is no way to acquire a CSRF token
for the ILS-DI API.

1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=ILS-DI
2. Enable "ILS-DI"
3. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD"
4. Note the 403 response

5. Apply the patch
6. sudo koha-plack --restart kohadev

7. curl -v localhost:8080/cgi-bin/koha/ilsdi.pl -d "service=AuthenticatePatron&username=REALUSER&password=REALPASSWORD"
8. Note the 200 response

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 12 Kyle M Hall (khall) 2024-10-25 11:50:54 UTC
Created attachment 173350 [details] [review]
Bug 36560: (QA follow-up) Tidy code

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 13 Katrin Fischer 2024-10-25 14:02:06 UTC
Might be good to have a quick note here that this means the ILS-DI service will work again.
Comment 14 Katrin Fischer 2024-10-25 14:42:23 UTC
Pushed for 24.11!

Well done everyone, thank you!
Comment 15 Lucas Gass (lukeg) 2024-11-20 23:32:04 UTC
Backported to 24.05.x for upcoming 24.05.06