"SameSite" is an attribute to a cookie. However, in Bug 26019 we have included it in as a HTTP response header for C4::Auth::checkauth(). As it is not a part of standard HTTP response headers, is there more to it, or can it be removed? https://github.com/Koha-Community/Koha/blob/59ff962caaa28c10ab1a57655ca588359dad367b/C4/Auth.pm#L1427
Created attachment 188449 [details] [review] Bug 41104: Catch invalid response header Samesite The SameSite is an attribute to a cookie, not a standard HTTP response header. We can safely remove it. To test: 1. Before applying further patches, 2. prove t/db_dependent/Auth.t 3. Observe test failure
Created attachment 188450 [details] [review] Bug 41104: Remove -sameSite from checkauth() response headers To test: 1. prove t/db_dependent/Auth.t 2. Observe success
(In reply to Lari Taskula from comment #1) > Created attachment 188449 [details] [review] [review] > Bug 41104: Catch invalid response header Samesite I'm not sure this test needs to be pushed. It does not really serve any purpose in the long run, after the second patch is pushed.
(In reply to Lari Taskula from comment #3) > (In reply to Lari Taskula from comment #1) > > Created attachment 188449 [details] [review] [review] [review] > > Bug 41104: Catch invalid response header Samesite > I'm not sure this test needs to be pushed. It does not really serve any > purpose in the long run, after the second patch is pushed. Yeah, I don't think it's really necessary either.
Comment on attachment 188449 [details] [review] Bug 41104: Catch invalid response header Samesite I'm going to mark it as obsolete for now, because I don't think the test adds too much value for the future.
Created attachment 188452 [details] [review] Bug 41104: Remove -sameSite from checkauth() response headers To test: 1. prove t/db_dependent/Auth.t 2. Observe success Signed-off-by: David Cook <dcook@prosentient.com.au>
Good catch on this one. What a little oopsie. Super easy to test in the browser by using the F12 tools and just checking for the presence of that SameSite HTTP header on the response from the server on the load of any page. The header is there before the patch, and the header is not there after the patch.