To reproduce: 1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg 2. Open browser developer tools 3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl 4. Open the Network tab, disable the cache, and shift refresh 5. Notice that bad.jpg fails to load with a 404 6. Try to login to Koha 7. Confirm 403 error 8. If you look at the cookies sent/received by mainpage.pl on the first load, the bad.jpg load, and the second mainpage.pl load, you'll see that first mainpage.pl returns a cookie, which is used by bad.jpg, which returns a new cookie, which is used by the second mainpage.pl However, the CSRF token submitted with the second mainpage.pl is tied to the cookie from the first mainpage.pl load! It'll never work! The solution is to stop 404.pl from returning a 404.pl cookie. After all, 404.pl shouldn't be creating/updating a cookie. It's just supposed to return a pretty 404 document.
I actually first noticed this problem after bug 35402 was pushed. It was crazymaking, but I noticed a 404 in the plack.log, and then I turned on the Apache access log, and realized it was a 404 for http://localhost:8081/intranet-tmpl/lib/bootstrap/bootstrap.bundle.min.js.map. It wasn't showing up in the Network tab, but if you go into "Sources" and look at the /intranet-tmpl/lib/bootstrap/bootstrap.bundle.min.js, you'll see at the bottom of the screen a message "Source map failed to load" and it mentions the 404 for the map file. Note: the browser only tries to load the map file when you have your dev tools open. So login won't work if you have your dev tools open, but it will if they're closed. Fun!
This problem really was first noticed by Nick on bug 37056, although the solution there was to fix the SVC API, which makes sense for that particular bug. But it's the same idea under the hood. The problem is that the CGISESSID cookie gets overridden by a background call which messes up the foreground.
Created attachment 170743 [details] [review] Bug 37741: Do not send cookie back from error pages This change stops the cookie from being sent back from error pages, so that backcalls that cause errors don't overwrite the existing cookie used by the foreground request page. Test plan: 0. Apply the patch and koha-plack --reload kohadev 1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg 2. Open browser developer tools 3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl 4. Open the Network tab, disable the cache, and shift refresh 5. Notice that bad.jpg fails to load with a 404 6. Try to login to Koha 7. Confirm login works *. Extra points if you note that the cookie returned by the first mainpage.pl request is used for the bad.jpg lookup and the second mainpage.pl request.
Created attachment 170794 [details] [review] Bug 37741: Do not send cookie back from error pages This change stops the cookie from being sent back from error pages, so that backcalls that cause errors don't overwrite the existing cookie used by the foreground request page. Test plan: 0. Apply the patch and koha-plack --reload kohadev 1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg 2. Open browser developer tools 3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl 4. Open the Network tab, disable the cache, and shift refresh 5. Notice that bad.jpg fails to load with a 404 6. Try to login to Koha 7. Confirm login works *. Extra points if you note that the cookie returned by the first mainpage.pl request is used for the bad.jpg lookup and the second mainpage.pl request. Signed-off-by: David Nind <david@davidnind.com>
I didn't go for the extra points! 8-) Tested in Firefox and Google Chrome on Ubuntu 22.04 (weird things were happening with Chromium...). I attempted a release note - I hope I have captured the essential parts so that it makes sense to library staff. It may be useful to add an example.
Thanks, David. I'll revise the release note. Thanks for adding it!
Created attachment 170897 [details] [review] Bug 37741: Do not send cookie back from error pages This change stops the cookie from being sent back from error pages, so that backcalls that cause errors don't overwrite the existing cookie used by the foreground request page. Test plan: 0. Apply the patch and koha-plack --reload kohadev 1. Set syspref IntranetFavicon to http://localhost:8081/cgi-bin/koha/bad.jpg 2. Open browser developer tools 3. Go to http://localhost:8081/cgi-bin/koha/mainpage.pl 4. Open the Network tab, disable the cache, and shift refresh 5. Notice that bad.jpg fails to load with a 404 6. Try to login to Koha 7. Confirm login works *. Extra points if you note that the cookie returned by the first mainpage.pl request is used for the bad.jpg lookup and the second mainpage.pl request. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Pushed for 24.11! Well done everyone, thank you!
Backported to 24.05.x for upcoming 24.05.06
Not for 23.11.x
This fixes an error, and no changes are required to the manual.