Bug 37388 - Login to staff fails with incorrect csrf token when using plack
Summary: Login to staff fails with incorrect csrf token when using plack
Status: CLOSED WORKSFORME
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: 24.05
Hardware: All All
: P5 - low critical
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-07-17 08:39 UTC by Nicholas van Oudtshoorn
Modified: 2025-06-02 20:46 UTC (History)
2 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Crowdfunding committed: 0
Crowdfunding contact:
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Nicholas van Oudtshoorn 2024-07-17 08:39:20 UTC
We've just migrated our installation to a new server, and updated to 24.05 while we're at it. I notice now that staff logins always fail, complaining about the csrf token, unless plack is disabled on the staff interface.

Happy to help figure this out - but am a bit lost on where this is being set etc.
Comment 1 Katrin Fischer 2024-07-17 08:48:24 UTC
Hi, please bring this up on the mailing list or better even on the Mattermost chat. We have quite some libraries using 24.05 already and staff logins don't seem to be compromised in general, so I think this is more of a support request for now until we know more.