In Koha 24.05 CSRF.pm ( https://git.koha-community.org/Koha-community/Koha/src/branch/main/Koha/Middleware/CSRF.pm ) expects all stateful methods (POST, PUT, DELETE, PATCH requests) to include a CSRF token. This includes requests to ILSDI ( https://wiki.koha-community.org/wiki/ILS-DI ). This requirement for a CSRF token for ILSDI, which is designed to be used cross site, means ILSDI requests do not work on 24.05 onwards. Several third-party systems need to connect to Koha via ILSDI, for example EDS in order to fetch RTAC (Real-Time Availability Check) data. EDS can also fetch RTAC data from Koha via Z39.50. Another is Bolinda (BorrowBox), an eBook platform, which authenticates Koha users via ILSDI. It would be nice to hear the communities views on what could/should be done to get ILSDI working again.
I am not very familiar with this code, but it seems that we have not touch ILSDI when requiring a CSRF token (which means it is still vulnerable). So the "routes" are still accessible via GET and will work (even for stateful requests).
This crazy stuff gives access to a lot of data without any authentication (I always forget that).
Is this maybe a duplicate to Bug 36560 - ILS-DI API doesn't have mechanism to provide CSRF tokens for POSTs ?
Arf this is a problem for Bokeh portal
*** This bug has been marked as a duplicate of bug 36560 ***