From 12d121a1fcf346cfd8b0801e25644bafa92c52f7 Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Thu, 13 Apr 2023 09:54:23 +0200 Subject: [PATCH] [v9.5.x] Auth: Remove the session cookie only if it's invalid or revoked (#66431) Auth: Remove the session cookie only if it's invalid or revoked (#65984) Remove the cookie if it's invalid or revoked (cherry picked from commit 4cac95d1c22cc553723ceb72218b3167b8d13dcf) Co-authored-by: Misi --- pkg/services/contexthandler/contexthandler.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/services/contexthandler/contexthandler.go b/pkg/services/contexthandler/contexthandler.go index 62c59721005..3c948fe6531 100644 --- a/pkg/services/contexthandler/contexthandler.go +++ b/pkg/services/contexthandler/contexthandler.go @@ -481,8 +481,8 @@ func (h *ContextHandler) initContextWithToken(reqContext *contextmodel.ReqContex token, err := h.AuthTokenService.LookupToken(ctx, rawToken) if err != nil { reqContext.Logger.Warn("failed to look up session from cookie", "error", err) - if errors.Is(err, auth.ErrUserTokenNotFound) || errors.Is(err, auth.ErrInvalidSessionToken) { - // Burn the cookie in case of invalid, expired or missing token + if errors.Is(err, auth.ErrInvalidSessionToken) { + // Burn the cookie in case of invalid or revoked token reqContext.Resp.Before(h.deleteInvalidCookieEndOfRequestFunc(reqContext)) }