Bug 40736 - OAuth/OIDC authentication broken when CGISESSID is missing
Summary: OAuth/OIDC authentication broken when CGISESSID is missing
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 33675
Blocks:
  Show dependency treegraph
 
Reported: 2025-09-01 10:45 UTC by Lari Taskula
Modified: 2025-09-01 10:46 UTC (History)
1 user (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Lari Taskula 2025-09-01 10:45:06 UTC
Our API error logs contain multiple instances of the following error

> [ERROR] Can't call method "value" on an undefined value at /usr/share/koha/lib/Koha/REST/V1/OAuth/Client.pm line 100.

Client.pm:100 is

>         $state = Koha::Token->new->generate_csrf( { session_id => $c->req->cookie('CGISESSID')->value } );

This happens when a web crawler (Googlebot in our case) navigates to OAuth/OIDC login API endpoint, and Koha attempts to generate them a new CSRF token but is unable to due to missing CGISESSID cookie.

To replicate:
1. Have an identity provider <provider code> defined under Administration > Identity providers
2. On a fresh browser session (clear cookies),
3. Navigate to https://yourkoha/api/v1/public/oauth/login/<provider code>/opac
4. Observe [ERROR] Can't call method "value" on an undefined value at /usr/share/koha/lib/Koha/REST/V1/OAuth/Client.pm line 100. in plack-api-error.log