Bug 40713 - cookieConsent: key should have an expiration date
Summary: cookieConsent: key should have an expiration date
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Owen Leonard
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-08-27 12:23 UTC by Marcel de Rooy
Modified: 2025-08-27 14:10 UTC (History)
1 user (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2025-08-27 12:23:00 UTC
Currently, the created localStorage key cookieConsent does not expire. This needs adjustment in view of following information:

"The GDPR does not specify a fixed time limit for cookie expiry; instead, the duration must be proportionate to the cookie's purpose and never exceed 12 months according to the ePrivacy Directive, which requires consent renewal at least annually, and potentially more frequently based on your local Data Protection Authority's (DPA) guidelines, like the six-month recommendations from the Irish DPC and French CNIL." -- See e.g. https://gdpr.eu/cookies/

"If you use a cookie to store a record that a user has given consent to the use of cookies, you should ask the user to reaffirm their consent no longer than six months [*] after you have stored this consent state. (Footnote: While the legislation does not prescribe a specific lifespan for such cookies, based on a first-principles analysis by the DPC, we consider this to be the appropriate default outer timeframe for storing the user’s consent state. A controller would need to objectively and on a case-by-case basis justify storage for a longer period.)" -- Data Protection Commission [Ireland]


Since localStorage has no expiration mechanism itself, we could simply add e.g. a unix timestamp as value here. Since the key now contains empty string and is tested for null to check status. This check would become: does the key exist and is its value still in future? A reject removes the key or clears it.

Would it be possible to add the expiry period to a preference or enclosed in CookieConsentedJS somehow?
Comment 1 Marcel de Rooy 2025-08-27 14:10:41 UTC
We need something similar for (some) patron consents (depending on type).
See bug 40715.