https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43782
Bug ID: 43782
Summary: GenerateCSRF caches token with global key causing
cross-session CSRF 403 errors on Plack workers
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: major
Priority: P5 - low
Component: Templates
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
Target Milestone: ---
Bug 35955 (commit 108c955ea) introduced caching of the CSRF token in
Koha::Template::Plugin::Koha::GenerateCSRF using Koha::Cache::Memory::Lite.
The cache uses a static key "CSRF-TOKEN" shared across all sessions served
by a Plack worker.
Because Koha::Cache::Memory::Lite is a package-level in-process hash that
is NOT flushed between requests (despite what its documentation says), the
cached token from the first session persists and is returned to all subsequent
sessions on the same worker process.
When session B receives session A's token and submits a form, CSRF validation
compares the token against session B's session_id — it was generated for
session A — and returns 403.
Symptoms:
- Intermittent "Invalid CSRF token" 403 errors
- Reproducible as "first request after idle period" (e.g. every morning)
- Affects both intranet login and OPAC self-checkout (sco-main.pl)
- Works on the second attempt (the second request gets the correct session's
token because the old cached value is still returned — but a reload
generates a new session and fresh token)
The 8-hour CSRF_EXPIRY_HOURS (Bug 17110) made the window smaller. After
Bug 42924 increased it to 168 hours, a worker running more than ~7 days
could additionally serve a near-expired token with less than 1 hour remaining.
Note: Bug 18124 correctly made CSRF tokens cryptographically session-specific.
The cache layer introduced by Bug 35955 bypasses that protection.
The issue can be hard to reproduce, so I have been using reports from customers
to piece this together.
--
You are receiving this mail because:
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
