Bug 36586 - Self-checkouts will get CSRF errors if left inactive for 8 hours
Summary: Self-checkouts will get CSRF errors if left inactive for 8 hours
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Self checkout (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-12 04:37 UTC by David Cook
Modified: 2024-11-06 22:10 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2024-04-12 04:37:29 UTC
Currently, the CSRF token is only good for 8 hours. This means that a self-checkout terminal left inactive for 8 hours (e.g. overnight, over a holiday closure, etc) will create a wrong CSRF token error on the first activity attempt in the morning.
Comment 1 David Cook 2024-04-12 04:44:52 UTC
I think the most obvious (but not necessarily the best) solution is to have a timer that refreshes the main SCO page at certain intervals. 

--

(Note that this same problem will probably arise with Vue.js driven pages.)
Comment 2 Jonathan Druart 2024-11-06 14:58:07 UTC
SCI has a SelfCheckInTimeout pref that refreshes the screen.
Comment 3 David Cook 2024-11-06 22:10:57 UTC
(In reply to Jonathan Druart from comment #2)
> SCI has a SelfCheckInTimeout pref that refreshes the screen.

That should do the trick. We could move that out to a .js file and use it in both interfaces.