From ddd790e4c5d2f867787111e49d688c5f80728bae Mon Sep 17 00:00:00 2001
From: David Cook <dcook@prosentient.com.au>
Date: Mon, 29 Jun 2026 06:56:25 +0000
Subject: [PATCH] Bug 42924: Restore default MaxAge for CSRF token

This patch changes the default MaxAge from 8 hours to
168 hours or 7 days due to usability issues encountered from
using a short-lived token.

See OWASP for more information on why timestamps with expiry
are not necessary for CSRF tokens. The MaxAge is a requirement
of the WWW::CSRF token used by Koha, so let's just use a longer
expiry in lieu of no expiry.

Test plan:
0. apply patch
1. prove t/Token.t

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
---
 Koha/Token.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Koha/Token.pm b/Koha/Token.pm
index 09419f1b95..bf27fc5e81 100644
--- a/Koha/Token.pm
+++ b/Koha/Token.pm
@@ -61,7 +61,7 @@ use Koha::Session;
 
 use base qw(Class::Accessor);
 use constant HMAC_SHA1_LENGTH    => 20;
-use constant CSRF_EXPIRY_HOURS   => 8;             # 8 hours instead of 7 days..
+use constant CSRF_EXPIRY_HOURS   => 168;           # 168 hours (ie 7 days..)
 use constant DEFA_SESSION_ID     => 0;
 use constant DEFA_SESSION_USERID => 'anonymous';