gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
Martin Renvoize 537a64a01b
Bug 42634: Force JWT cookie deletion on self-checkout logout 
The web-based self-checkout (opac/sco/sco-main.pl) builds the
response JWT cookie with -expires => $jwt ? '+1d' : ''. On logout
$jwt is undef, so the cookie is sent with an empty value and no
Expires attribute - i.e. a session cookie with an empty value
rather than a deletion. Some browsers/proxies retain the previous
valid JWT in this scenario, which presents as the Finish/close
button "doing nothing" or working only intermittently: the patron
appears to remain logged in despite clicking Finish.

Use a past Expires ('-1d') when no JWT is present so the browser
deletes the cookie entirely. The subsequent ?op=logout render
cannot then rediscover the patron from a stale cookie.

Test plan:
1. Enable web-based self-checkout (SelfCheckoutByLogin or
   SelfCheckAllowByIPRanges).
2. Log in as a patron at /cgi-bin/koha/sco/sco-main.pl.
3. Open DevTools -> Application -> Cookies and note the JWT cookie.
4. Click the green "Finish" button.
5. Without the patch: Set-Cookie on the ?op=logout response shows
   JWT= with no Expires; the cookie persists as an empty session
   cookie.
6. With the patch: Set-Cookie shows JWT=; expires=<past date>; the
   browser removes the cookie entirely.
7. Confirm the kiosk reliably returns to the login screen and
   subsequent page loads do not re-authenticate from a stale JWT.

Sponsored-by: OpenFifth
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Emmi Takkinen <emmi.takkinen@koha-suomi.fi>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
 		2026-08-28 16:36:34 +00:00
..
clubs Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
errors Bug 28146: Respect ReplytoDefault in error pages 2025-10-09 14:58:41 -06:00
external/overdrive Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
sci Bug 34596: Add rebuild queue where needed for existing calls to AddReturn 2025-10-06 09:15:17 -06:00
sco Bug 42634: Force JWT cookie deletion on self-checkout logout 2026-08-28 16:36:34 +00:00
svc Bug 41919: Limit number of current reports a single user can run simultaneously 2026-05-07 07:56:21 -06:00
ilsdi.pl Bug 42764: Fix spelling errors across the codebase 2026-06-03 16:09:04 +00:00
maintenance.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
oai.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-ISBDdetail.pl Bug 39337: Add is_opac_suppressed helper to C4::Context 2026-08-25 08:56:25 +00:00
opac-MARCdetail.pl Bug 39337: Add is_opac_suppressed helper to C4::Context 2026-08-25 08:56:25 +00:00
opac-account-pay-return.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-account-pay.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-account.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-addbybiblionumber.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-alert-subscribe.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-alert-subscriptions.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-article-request-cancel.pl Bug 41558: Fix and standardize links to tab on opac-user 2026-03-05 08:33:55 -07:00
opac-authorities-home.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-authoritiesdetail.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-basket.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-blocked.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-browse.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-browser.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-changelanguage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-course-details.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-course-reserves.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-curbside-pickups.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-detail.pl Bug 39337: Add is_opac_suppressed helper to C4::Context 2026-08-25 08:56:25 +00:00
opac-discharge.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-dismiss-message.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-downloadcart.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-downloadshelf.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-export.pl Bug 41084: Allow utf8 export format when EnableZotero is enabled 2026-07-17 13:49:08 +00:00
opac-holdshistory.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-ics.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-idref.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-illrequests-unauthenticated.pl Bug 36197: (QA follow-up): Adopt POST REDIRECT GET pattern 2025-04-25 08:47:11 +02:00
opac-illrequests.pl Bug 41204: Fallback to Standard earlier 2026-02-06 15:17:15 -07:00
opac-image.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-imageviewer.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-issue-note.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-library.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-main.pl Bug 42570: Use count_holds for OPAC patron summary pending holds 2026-05-18 09:30:16 -06:00
opac-memberentry.pl Bug 26355: (follow-up) Fix handling of extended attributes 2026-05-01 09:30:04 -06:00
opac-messaging.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-modrequest-suspend.pl Bug 41558: Fix and standardize links to tab on opac-user 2026-03-05 08:33:55 -07:00
opac-modrequest.pl Bug 42764: Fix spelling errors across the codebase 2026-06-03 16:09:04 +00:00
opac-mymessages.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-news-rss.pl Bug 42017: Fix content type of OPAC news RSS 2026-04-09 08:27:17 -06:00
opac-overdrive-search.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-page.pl Bug 43019: Fix branch comparison 2026-08-11 12:39:47 +00:00
opac-passwd.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-password-recovery.pl Bug 39325: Automatic fix 2025-04-28 18:51:22 +02:00
opac-patron-consent.pl Bug 41662: Prevent CSRF on opac-patron-consent.pl 2026-01-29 15:11:21 -07:00
opac-patron-image.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-privacy.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-ratings.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-readingrecord.pl Bug 41479: Remove Baker & Taylor integration 2026-03-24 07:50:10 +01:00
opac-recall.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-recalls.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-registration-verify.pl Bug 41076: Adjust our perl tidiness for v20250105 2026-02-05 09:03:51 -07:00
opac-renew.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-reportproblem.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-request-article.pl Bug 41558: Fix and standardize links to tab on opac-user 2026-03-05 08:33:55 -07:00
opac-reserve.pl Bug 23415: (QA follow-up) Fix spelling: oweing -> owing 2026-03-22 23:15:45 +01:00
opac-reset-password.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-restrictedpage.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-retrieve-file.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-review.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-routing-lists.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-search-history.pl Bug 41454: Remove unused dbh calls 2026-04-15 09:14:51 -06:00
opac-search.pl Bug 39337: Add is_opac_suppressed helper to C4::Context 2026-08-25 08:56:25 +00:00
opac-sendbasket.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-sendshelf.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-serial-issues.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-shareshelf.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-shelves.pl Bug 20846: Filter suppressed records from public lists in OPAC 2026-08-21 14:31:50 +00:00
opac-showmarc.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-showreviews.pl Bug 42567: Remove C4::Koha::GetNormalizedEAN in favor of MetadataExtractor 2026-08-20 15:34:10 +00:00
opac-suggestions.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-tags.pl Bug 39055: Change "op" to "login_op" when logging in to allow original op to flow through 2026-03-19 10:51:27 +00:00
opac-tags_subject.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-topissues.pl Bug 40163: Fix several http addresses in the code docs 2025-09-23 16:21:29 -06:00
opac-user.pl Bug 42566: Remove C4::Koha::GetNormalizedUPC in favor of MetadataExtractor 2026-08-20 15:34:08 +00:00
opac-virtual-card.pl Bug 40659: (follow-up) Use UI language for custom virtual card layout 2026-04-23 16:04:13 -06:00
tracklinks.pl Bug 30261: Render opac 404 for opac/tracklinks.pl 2026-03-20 11:54:32 +00:00
unapi Bug 41261: Valid inputs to unapi 2026-04-14 10:48:48 -06:00