Bug 37899 - Koha ILSDI endpoints expect a CSRF token - so ILSDI requests fail
Summary: Koha ILSDI endpoints expect a CSRF token - so ILSDI requests fail
Status: RESOLVED DUPLICATE of bug 36560
Alias: None
Product: Koha
Classification: Unclassified
Component: Web services (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-09-12 03:31 UTC by Alex Buckley
Modified: 2024-09-24 17:52 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alex Buckley 2024-09-12 03:31:29 UTC
In Koha 24.05 CSRF.pm ( https://git.koha-community.org/Koha-community/Koha/src/branch/main/Koha/Middleware/CSRF.pm ) expects all stateful methods (POST, PUT, DELETE, PATCH requests) to include a CSRF token.
This includes requests to ILSDI ( https://wiki.koha-community.org/wiki/ILS-DI ).

This requirement for a CSRF token for ILSDI, which is designed to be used cross site, means ILSDI requests do not work on 24.05 onwards.

Several third-party systems need to connect to Koha via ILSDI, for example EDS in order to fetch RTAC (Real-Time Availability Check) data. EDS can also fetch RTAC data from Koha via Z39.50. Another is Bolinda (BorrowBox), an eBook platform, which authenticates Koha users via ILSDI.

It would be nice to hear the communities views on what could/should be done to get ILSDI working again.
Comment 1 Jonathan Druart 2024-09-12 06:47:15 UTC
I am not very familiar with this code, but it seems that we have not touch ILSDI when requiring a CSRF token (which means it is still vulnerable).

So the "routes" are still accessible via GET and will work (even for stateful requests).
Comment 2 Jonathan Druart 2024-09-12 06:48:33 UTC
This crazy stuff gives access to a lot of data without any authentication (I always forget that).
Comment 3 Katrin Fischer 2024-09-12 06:56:20 UTC
Is this maybe a duplicate to Bug 36560 - ILS-DI API doesn't have mechanism to provide CSRF tokens for POSTs ?
Comment 4 Fridolin Somers 2024-09-12 10:31:30 UTC
Arf this is a problem for Bokeh portal
Comment 5 David Cook 2024-09-24 17:52:45 UTC

*** This bug has been marked as a duplicate of bug 36560 ***