Bug 36681 - CSRF_TOKEN header should be named CSRF-TOKEN (hyphen instead of underscore)
Summary: CSRF_TOKEN header should be named CSRF-TOKEN (hyphen instead of underscore)
Status: RESOLVED DUPLICATE of bug 36700
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-24 09:15 UTC by Julian Maurice
Modified: 2024-05-03 06:13 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Julian Maurice 2024-04-24 09:15:24 UTC
By default, nginx ignores invalid headers and header names containing underscores are considered invalid

https://nginx.org/en/docs/http/ngx_http_core_module.html#ignore_invalid_headers
https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers

Changing the underscore to an hyphen would allow to keep the default nginx configuration
Comment 1 Julian Maurice 2024-05-03 06:10:11 UTC

*** This bug has been marked as a duplicate of bug 36700 ***