Bug 7810 - C4/Auth.pm - on plack restart session is undefined
Summary: C4/Auth.pm - on plack restart session is undefined
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: 3.8
Hardware: All All
: P5 - low normal (vote)
Assignee: Dobrica Pavlinusic
QA Contact: Ian Walls
Depends on:
Blocks: 7172
  Show dependency treegraph
Reported: 2012-03-23 08:57 UTC by Dobrica Pavlinusic
Modified: 2013-12-05 20:04 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:

Bug 7810 - C4/Auth.pm - on pack restart session is undefined (1.08 KB, patch)
2012-03-23 08:58 UTC, Dobrica Pavlinusic
Details | Diff | Splinter Review
Bug 7810 - C4/Auth.pm - on plack restart session is undefined (1.27 KB, patch)
2012-06-10 14:36 UTC, Jared Camins-Esakov
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Dobrica Pavlinusic 2012-03-23 08:57:32 UTC

Comment 1 Dobrica Pavlinusic 2012-03-23 08:58:33 UTC Comment hidden (obsolete)
Comment 2 Alex Arnaud 2012-03-27 08:50:59 UTC
Dobrica, what do you mean by "restart session"?

Restart plack ? i did it but didn't get application error
Comment 3 Dobrica Pavlinusic 2012-03-27 12:30:51 UTC
My assumption was that it happends when browser still has cookie and session is already expired, but I'm unable to reproduce it fiddeling with session files manually.

I will mark it INVALID and wait for it to happen again :-)
Comment 4 Dobrica Pavlinusic 2012-03-27 12:57:38 UTC
I got lucky (kind of). I restarted plack (using plackup only, not starman) and got following error on /cgi-bin/koha/mainpage.pl

Can't call method "delete" on an undefined value at /srv/koha/C4/Auth.pm line 693, <DATA> line 522.
 at /srv/koha/mainpage.pl line 67

Since my patch fixes that line, I'm reopening the bug.

Only way to recover from this error is to manually delete cookie which is not really good solution for users.

My session looks very strange:

dpavlin@koha-dev:/tmp$ sudo cat /tmp/cgisess_b77b83762178c18a0e7a3ac4f4e50738
_SESSION_ATIME: '1332851288'
_SESSION_CTIME: '1332851288'
_SESSION_ID: b77b83762178c18a0e7a3ac4f4e50738

and corrent time on system is:

dpavlin@koha-dev:/tmp$ perl -e 'print time(),$/'

My $timeout is 3600 which doesn't really explain why I end up in this code path since 1332852562 - 1332851288 = 1274
Comment 5 Dobrica Pavlinusic 2012-03-29 12:46:50 UTC
I can easily reproduce this bug by changing Koha site for plack using tools from Bug 7844
Comment 6 Alex Arnaud 2012-04-03 13:46:59 UTC
Dobrica how can you do that. I start koha using your tools from Bug 7844. But i still can't reproduce the bug ...
Comment 7 Dobrica Pavlinusic 2012-04-03 14:17:25 UTC
1. start one site using plack
   ./opac-plack.sh site1
2. login into site1 http://koha-dev.example.com:5000/
3. stop plack and start another site, start another site
   ./opac-plack.sh site2
4. reload page = bug

Work-around this bug is to use wildcard DNS with something like


and then use different URLs for each site so browser will do cookie scoping for us, e.g.


However, we might also change our cookie name (CGISESSID) to something else:

a) site name (if we want to allow single login for opac and intranet) or
b) site name+port (if we want separate logins)

But that's probably for another bug.
Comment 8 Jared Camins-Esakov 2012-06-10 14:36:44 UTC
Created attachment 10120 [details] [review]
Bug 7810 - C4/Auth.pm - on plack restart session is undefined

So we shouldn't try to delete it. This produces application error
instead of redirection to login page.

I had similar problems with CGI, especially when session in browser
is still active, and one on filesystem or database is already expired.

Signed-off-by: Jared Camins-Esakov <jcamins@cpbibliography.com>
Solved the problem when my Plack installation started acting up due to
stale cookies.
Comment 9 Paul Poulain 2012-06-11 16:11:00 UTC
QA comment: tiny patch that can't be harmfull in CGI mode, as it just add a test
Comment 10 Jared Camins-Esakov 2012-12-31 01:05:15 UTC
There have been no further reports of problems so I am marking this bug resolved.