From 06bac7582f94e98a2ef288206ffaa2ac98a4dec0 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Mon, 4 May 2026 14:58:32 +0200
Subject: [PATCH] Bug 42066: Prevent 403 after an expired OPAC session

If a session has expired, the login form will get an empty CSRF token
and the login form will return 403

To recreate:
hit /cgi-bin/koha/sco/sco-main.pl
then hit /cgi-bin/koha/opac-main.pl
login
=> 403
Apply this patch, try again
=> Success

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
---
 C4/Auth.pm | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 29823d6ed5..1461b0d880 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -275,15 +275,18 @@ sub get_template_and_user {
         }
 
         if ($kick_out) {
+            $session  = get_session("");
             $template = C4::Templates::gettemplate(
                 'opac-auth.tt', 'opac',
                 $in->{query}
             );
+            $template->param( sessionID => $session->id );
+
             $cookie = $cookie_mgr->replace_in_list(
                 $cookie,
                 $in->{query}->cookie(
                     -name     => 'CGISESSID',
-                    -value    => '',
+                    -value    => $session->id,
                     -HttpOnly => 1,
                     -secure   => ( C4::Context->https_enabled() ? 1 : 0 ),
                     -sameSite => 'Lax',