Bug 41104 - Samesite HTTP response header being set in C4::Auth::checkauth()
Summary: Samesite HTTP response header being set in C4::Auth::checkauth()
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low trivial
Assignee: Lari Taskula
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 38363
  Show dependency treegraph
 
Reported: 2025-10-26 11:38 UTC by Lari Taskula
Modified: 2025-10-27 09:36 UTC (History)
1 user (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 41104: Catch invalid response header Samesite (1.42 KB, patch)
2025-10-26 11:42 UTC, Lari Taskula
Details | Diff | Splinter Review
Bug 41104: Remove -sameSite from checkauth() response headers (731 bytes, patch)
2025-10-26 11:42 UTC, Lari Taskula
Details | Diff | Splinter Review
Bug 41104: Remove -sameSite from checkauth() response headers (783 bytes, patch)
2025-10-26 22:48 UTC, David Cook
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Lari Taskula 2025-10-26 11:38:47 UTC
"SameSite" is an attribute to a cookie. However, in Bug 26019 we have included it in as a HTTP response header for C4::Auth::checkauth(). As it is not a part of standard HTTP response headers, is there more to it, or can it be removed?

https://github.com/Koha-Community/Koha/blob/59ff962caaa28c10ab1a57655ca588359dad367b/C4/Auth.pm#L1427
Comment 1 Lari Taskula 2025-10-26 11:42:05 UTC
Created attachment 188449 [details] [review]
Bug 41104: Catch invalid response header Samesite

The SameSite is an attribute to a cookie, not a standard HTTP response header.

We can safely remove it.

To test:
1. Before applying further patches,
2. prove t/db_dependent/Auth.t
3. Observe test failure
Comment 2 Lari Taskula 2025-10-26 11:42:07 UTC
Created attachment 188450 [details] [review]
Bug 41104: Remove -sameSite from checkauth() response headers

To test:
1. prove t/db_dependent/Auth.t
2. Observe success
Comment 3 Lari Taskula 2025-10-26 14:59:53 UTC
(In reply to Lari Taskula from comment #1)
> Created attachment 188449 [details] [review] [review]
> Bug 41104: Catch invalid response header Samesite
I'm not sure this test needs to be pushed. It does not really serve any purpose in the long run, after the second patch is pushed.
Comment 4 David Cook 2025-10-26 22:45:29 UTC
(In reply to Lari Taskula from comment #3)
> (In reply to Lari Taskula from comment #1)
> > Created attachment 188449 [details] [review] [review] [review]
> > Bug 41104: Catch invalid response header Samesite
> I'm not sure this test needs to be pushed. It does not really serve any
> purpose in the long run, after the second patch is pushed.

Yeah, I don't think it's really necessary either.
Comment 5 David Cook 2025-10-26 22:46:17 UTC
Comment on attachment 188449 [details] [review]
Bug 41104: Catch invalid response header Samesite

I'm going to mark it as obsolete for now, because I don't think the test adds too much value for the future.
Comment 6 David Cook 2025-10-26 22:48:34 UTC
Created attachment 188452 [details] [review]
Bug 41104: Remove -sameSite from checkauth() response headers

To test:
1. prove t/db_dependent/Auth.t
2. Observe success

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 7 David Cook 2025-10-26 22:49:45 UTC
Good catch on this one. What a little oopsie. 

Super easy to test in the browser by using the F12 tools and just checking for the presence of that SameSite HTTP header on the response from the server on the load of any page. 

The header is there before the patch, and the header is not there after the patch.