Bug 36586 - Self-checkouts will get CSRF errors if left inactive for 8 hours
Summary: Self-checkouts will get CSRF errors if left inactive for 8 hours
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Self checkout (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-12 04:37 UTC by David Cook
Modified: 2024-07-15 17:54 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2024-04-12 04:37:29 UTC 
Currently, the CSRF token is only good for 8 hours. This means that a self-checkout terminal left inactive for 8 hours (e.g. overnight, over a holiday closure, etc) will create a wrong CSRF token error on the first activity attempt in the morning.
Comment 1 David Cook 2024-04-12 04:44:52 UTC 
I think the most obvious (but not necessarily the best) solution is to have a timer that refreshes the main SCO page at certain intervals. 

--

(Note that this same problem will probably arise with Vue.js driven pages.)