gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 42924: Restore default MaxAge for CSRF token 

This patch changes the default MaxAge from 8 hours to
168 hours or 7 days due to usability issues encountered from
using a short-lived token.

See OWASP for more information on why timestamps with expiry
are not necessary for CSRF tokens. The MaxAge is a requirement
of the WWW::CSRF token used by Koha, so let's just use a longer
expiry in lieu of no expiry.

Test plan:
0. apply patch
1. prove t/Token.t

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>
This commit is contained in:
David Cook 2026-06-29 06:56:25 +00:00 committed by Pedro Amorim
parent bfc6866200
commit ddd790e4c5
No known key found for this signature in database
GPG Key ID: 06B75BA7F3894D55
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Koha/Token.pm
View File

@ -61,7 +61,7 @@ use Koha::Session;
use base qw(Class::Accessor);
use constant HMAC_SHA1_LENGTH => 20;
use constant CSRF_EXPIRY_HOURS => 8; # 8 hours instead of 7 days..
use constant CSRF_EXPIRY_HOURS => 168; # 168 hours (ie 7 days..)
use constant DEFA_SESSION_ID => 0;
use constant DEFA_SESSION_USERID => 'anonymous';