From 4cac95d1c22cc553723ceb72218b3167b8d13dcf Mon Sep 17 00:00:00 2001 From: Misi Date: Thu, 13 Apr 2023 09:23:39 +0200 Subject: [PATCH] Auth: Remove the session cookie only if it's invalid or revoked (#65984) Remove the cookie if it's invalid or revoked --- pkg/services/contexthandler/contexthandler.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/services/contexthandler/contexthandler.go b/pkg/services/contexthandler/contexthandler.go index d55b931ec9d8f..b0b962730941d 100644 --- a/pkg/services/contexthandler/contexthandler.go +++ b/pkg/services/contexthandler/contexthandler.go @@ -481,8 +481,8 @@ func (h *ContextHandler) initContextWithToken(reqContext *contextmodel.ReqContex token, err := h.AuthTokenService.LookupToken(ctx, rawToken) if err != nil { reqContext.Logger.Warn("failed to look up session from cookie", "error", err) - if errors.Is(err, auth.ErrUserTokenNotFound) || errors.Is(err, auth.ErrInvalidSessionToken) { - // Burn the cookie in case of invalid, expired or missing token + if errors.Is(err, auth.ErrInvalidSessionToken) { + // Burn the cookie in case of invalid or revoked token reqContext.Resp.Before(h.deleteInvalidCookieEndOfRequestFunc(reqContext)) }