gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42719: [26.05.x] Handle missing CGISESSID in OAuth login (IdP-initiated flow) 

When a user initiates login from the IdP (e.g. Okta app tile), they
hit the OAuth endpoint without an existing session cookie. The code
crashed calling ->value on an undefined cookie object.

This patch:
- Removes the premature 'No user session found' guard that blocked
  IdP-initiated flows entirely
- Creates a session on-the-fly for the initial request when no
  cookie exists (IdP-initiated flow)
- On callback, redirects with wrong_csrf_token error instead of
  crashing when the cookie is missing

CSRF protection is preserved: the state token is bound to the
session created in the initial request, and the browser returns
the cookie on callback for validation.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit cd02922675f42f1c404acaa274d14fd155778941)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Tomás Cohen Arazi 2026-08-19 09:31:38 -03:00 committed by Lucas Gass
parent 417ac6fb03
commit 44cc4b367e
No known key found for this signature in database
GPG Key ID: 60B447398B0D36CA
1 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
Koha/REST/V1/OAuth/Client.pm
View File

@ -66,10 +66,11 @@ sub login {
}
my $current_session;
my $session_id;
my $current_session_cookie = $c->req->cookie('CGISESSID');
if ($current_session_cookie) {
my $current_session_id = $current_session_cookie->value;
$current_session = Koha::Session->get_session( { sessionID => $current_session_id } );
$session_id = $current_session_cookie->value;
$current_session = Koha::Session->get_session( { sessionID => $session_id } );
}
unless ( $provider_config && $provider_config->{authorize_url} ) {
@ -91,10 +92,15 @@ sub login {
if ($is_callback) {
# callback, check CSRF token
unless ($session_id) {
my $error = "wrong_csrf_token";
return $c->redirect_to( $uri . "?auth_error=$error" );
}
unless (
Koha::Token->new->check_csrf(
{
session_id => $c->req->cookie('CGISESSID')->value,
session_id => $session_id,
token => $c->param('state'),
}
)
@ -105,8 +111,14 @@ sub login {
}
} else {
# initial request, generate CSRF token
$state = Koha::Token->new->generate_csrf( { session_id => $c->req->cookie('CGISESSID')->value } );
# initial request — create session if needed (IdP-initiated flow)
unless ($session_id) {
$current_session = Koha::Session->get_session( {} );
$session_id = $current_session->id;
$c->cookie( CGISESSID => $session_id, { path => '/' } );
}
$state = Koha::Token->new->generate_csrf( { session_id => $session_id } );
Koha::Auth::Identity::Referer->store_referer(
{