public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[v9.5.x] Auth: Remove the session cookie only if it's invalid or revoked (#66431)

Browse Source 
Auth: Remove the session cookie only if it's invalid or revoked (#65984)

Remove the cookie if it's invalid or revoked

(cherry picked from commit 4cac95d1c2)

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
This commit is contained in:
Grot (@grafanabot)
2023-04-13 09:54:23 +02:00
committed by GitHub
co-authored by Misi
parent c956cd2a32
commit 12d121a1fc
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/contexthandler/contexthandler.go
+2 -2
View File
@@ -481,8 +481,8 @@ func (h *ContextHandler) initContextWithToken(reqContext *contextmodel.ReqContex
token, err := h.AuthTokenService.LookupToken(ctx, rawToken)
if err != nil {
reqContext.Logger.Warn("failed to look up session from cookie", "error", err)
if errors.Is(err, auth.ErrUserTokenNotFound) || errors.Is(err, auth.ErrInvalidSessionToken) {
// Burn the cookie in case of invalid, expired or missing token
if errors.Is(err, auth.ErrInvalidSessionToken) {
// Burn the cookie in case of invalid or revoked token
reqContext.Resp.Before(h.deleteInvalidCookieEndOfRequestFunc(reqContext))
}