From 537a64a01b8a94f2157ffff1c9a3b29ae612aa45 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Mon, 18 May 2026 16:13:53 +0100 Subject: [PATCH] Bug 42634: Force JWT cookie deletion on self-checkout logout The web-based self-checkout (opac/sco/sco-main.pl) builds the response JWT cookie with -expires => $jwt ? '+1d' : ''. On logout $jwt is undef, so the cookie is sent with an empty value and no Expires attribute - i.e. a session cookie with an empty value rather than a deletion. Some browsers/proxies retain the previous valid JWT in this scenario, which presents as the Finish/close button "doing nothing" or working only intermittently: the patron appears to remain logged in despite clicking Finish. Use a past Expires ('-1d') when no JWT is present so the browser deletes the cookie entirely. The subsequent ?op=logout render cannot then rediscover the patron from a stale cookie. Test plan: 1. Enable web-based self-checkout (SelfCheckoutByLogin or SelfCheckAllowByIPRanges). 2. Log in as a patron at /cgi-bin/koha/sco/sco-main.pl. 3. Open DevTools -> Application -> Cookies and note the JWT cookie. 4. Click the green "Finish" button. 5. Without the patch: Set-Cookie on the ?op=logout response shows JWT= with no Expires; the cookie persists as an empty session cookie. 6. With the patch: Set-Cookie shows JWT=; expires=; the browser removes the cookie entirely. 7. Confirm the kiosk reliably returns to the login screen and subsequent page loads do not re-authenticate from a stale JWT. Sponsored-by: OpenFifth Signed-off-by: David Nind Signed-off-by: Emmi Takkinen Signed-off-by: David Cook Signed-off-by: Pedro Amorim --- opac/sco/sco-main.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl index 47bce8786b..4ab872c900 100755 --- a/opac/sco/sco-main.pl +++ b/opac/sco/sco-main.pl @@ -468,7 +468,7 @@ $cookie = $cookie_mgr->replace_in_list( $query->cookie( -name => 'JWT', -value => $jwt // '', - -expires => $jwt ? '+1d' : '', + -expires => $jwt ? '+1d' : '-1d', -HttpOnly => 1, -secure => ( C4::Context->https_enabled() ? 1 : 0 ), -sameSite => 'Lax'