https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33259
--- Comment #62 from David Cook <[email protected]> --- Created attachment 203866 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203866&action=edit Bug 33259: Add SameSite option of Strict or Lax for CGISESSID cookie This change refactors CGISESSID cookie creation to make it easier to change CGISESSID cookie attributes. In the process, it uses the SameSiteSessionCookie system preference to determine whether to be Lax or Strict. By default on upgraded instances, the setting is Lax. On new instances, it's Strict. This is so not to disrupt existing workflows. Test plan: 0. Apply the patch 1. sudo koha-upgrade-schema kohadev 2. Open the Network tab of the dev tools, 3. Go to http://localhost:8081/cgi-bin/koha/installer/install.pl 4. Note that the CGISESSID cookie is Lax after upgrading 5. Set SameSiteSessionCookie system preference to Strict 6. Go to http://localhost:8081/cgi-bin/koha/installer/install.pl 7. Note that the CGISESSID cookie is Strict 8. Run through the installer successfully 9. Log into the staff interface and the OPAC (noting the CGISESSID cookie has SameSite Strict) 10. Set up a Keycloak IdP and register it with Koha as per https://wiki.koha-community.org/wiki/Testing_SSO#Keycloak 11. In an Incognito/Private window, go to Koha, and then log into Koha via Keycloak. Note that the SSO works successfully. 12. Authenticate koha user using svc/authentication API endpoint (See https://wiki.koha-community.org/wiki/Koha_/svc/_HTTP_API specifically "Changes_coming_in_Koha_24.05" for more information) -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
