Bug 37741 - Koha errors on page (e.g. 404) cause incorrect CSRF errors
Summary: Koha errors on page (e.g. 404) cause incorrect CSRF errors
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low critical
Assignee: David Cook
QA Contact: Chris Cormack
URL:
Keywords:
Depends on: 36192
Blocks:
  Show dependency tree / graph
 
Reported: 2024-08-27 01:38 UTC by David Cook
Modified: 2024-08-30 10:46 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
This change prevents an error in a background call (e.g. a missing favicon.ico) from affecting the user's session, which can lead to incorrect CSRF 403 errors during form POSTs. (The issue is prevented by stopping error pages from returning the CGISESSID cookie, which overwrites the CGISESSID cookie returned by the foreground page.)
Version(s) released in:
24.11.00
Circulation function:

Attachments
Bug 37741: Do not send cookie back from error pages (6.02 KB, patch)
2024-08-27 01:53 UTC, David Cook 		Details | Diff | Splinter Review
Bug 37741: Do not send cookie back from error pages (6.07 KB, patch)
2024-08-28 02:17 UTC, David Nind 		Details | Diff | Splinter Review
Bug 37741: Do not send cookie back from error pages (6.15 KB, patch)
2024-08-30 01:44 UTC, Chris Cormack 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2024-08-27 01:38:50 UTC 
To reproduce:
1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg
2. Open browser developer tools
3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl
4. Open the Network tab, disable the cache, and shift refresh
5. Notice that bad.jpg fails to load with a 404
6. Try to login to Koha
7. Confirm 403 error
8. If you look at the cookies sent/received by mainpage.pl on the first load, the bad.jpg load, and the second mainpage.pl load, you'll see that first mainpage.pl returns a cookie, which is used by bad.jpg, which returns a new cookie, which is used by the second mainpage.pl

However, the CSRF token submitted with the second mainpage.pl is tied to the cookie from the first mainpage.pl load! It'll never work!

The solution is to stop 404.pl from returning a 404.pl cookie. After all, 404.pl shouldn't be creating/updating a cookie. It's just supposed to return a pretty 404 document.
Comment 1 David Cook 2024-08-27 01:41:40 UTC 
I actually first noticed this problem after bug 35402 was pushed.

It was crazymaking, but I noticed a 404 in the plack.log, and then I turned on the Apache access log, and realized it was a 404 for http://localhost:8081/intranet-tmpl/lib/bootstrap/bootstrap.bundle.min.js.map.

It wasn't showing up in the Network tab, but if you go into "Sources" and look at the /intranet-tmpl/lib/bootstrap/bootstrap.bundle.min.js, you'll see at the bottom of the screen a message "Source map failed to load" and it mentions the 404 for the map file.

Note: the browser only tries to load the map file when you have your dev tools open. So login won't work if you have your dev tools open, but it will if they're closed. Fun!
Comment 2 David Cook 2024-08-27 01:43:26 UTC 
This problem really was first noticed by Nick on bug 37056, although the solution there was to fix the SVC API, which makes sense for that particular bug. But it's the same idea under the hood. 

The problem is that the CGISESSID cookie gets overridden by a background call which messes up the foreground.
Comment 3 David Cook 2024-08-27 01:53:57 UTC 
Created attachment 170743 [details] [review]
Bug 37741: Do not send cookie back from error pages

This change stops the cookie from being sent back from error pages,
so that backcalls that cause errors don't overwrite the existing cookie
used by the foreground request page.

Test plan:
0. Apply the patch and koha-plack --reload kohadev
1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg
2. Open browser developer tools
3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl
4. Open the Network tab, disable the cache, and shift refresh
5. Notice that bad.jpg fails to load with a 404
6. Try to login to Koha
7. Confirm login works

*. Extra points if you note that the cookie returned by the first
mainpage.pl request is used for the bad.jpg lookup and the second
mainpage.pl request.
Comment 4 David Nind 2024-08-28 02:17:13 UTC 
Created attachment 170794 [details] [review]
Bug 37741: Do not send cookie back from error pages

This change stops the cookie from being sent back from error pages,
so that backcalls that cause errors don't overwrite the existing cookie
used by the foreground request page.

Test plan:
0. Apply the patch and koha-plack --reload kohadev
1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg
2. Open browser developer tools
3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl
4. Open the Network tab, disable the cache, and shift refresh
5. Notice that bad.jpg fails to load with a 404
6. Try to login to Koha
7. Confirm login works

*. Extra points if you note that the cookie returned by the first
mainpage.pl request is used for the bad.jpg lookup and the second
mainpage.pl request.

Signed-off-by: David Nind <david@davidnind.com>
Comment 5 David Nind 2024-08-28 02:22:34 UTC 
I didn't go for the extra points! 8-)

Tested in Firefox and Google Chrome on Ubuntu 22.04 (weird things were happening with Chromium...).

I attempted a release note - I hope I have captured the essential parts so that it makes sense to library staff. It may be useful to add an example.
Comment 6 David Cook 2024-08-28 02:58:06 UTC 
Thanks, David. I'll revise the release note. Thanks for adding it!
Comment 7 Chris Cormack 2024-08-30 01:44:25 UTC 
Created attachment 170897 [details] [review]
Bug 37741: Do not send cookie back from error pages

This change stops the cookie from being sent back from error pages,
so that backcalls that cause errors don't overwrite the existing cookie
used by the foreground request page.

Test plan:
0. Apply the patch and koha-plack --reload kohadev
1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg
2. Open browser developer tools
3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl
4. Open the Network tab, disable the cache, and shift refresh
5. Notice that bad.jpg fails to load with a 404
6. Try to login to Koha
7. Confirm login works

*. Extra points if you note that the cookie returned by the first
mainpage.pl request is used for the bad.jpg lookup and the second
mainpage.pl request.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Comment 8 Katrin Fischer 2024-08-30 10:46:41 UTC 
Pushed for 24.11!

Well done everyone, thank you!