If LookupToken fails we don't clear the auth token cookie.
Ref #15316
(cherry picked from commit 747f3cd300)
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
This commit is contained in:
co-authored by
Marcus Efraimsson
parent
01ed0afb9f
commit
5dcfad56cf
@@ -257,12 +257,6 @@ func (h *ContextHandler) initContextWithToken(ctx *models.ReqContext, orgID int6
|
||||
token, err := h.AuthTokenService.LookupToken(ctx.Req.Context(), rawToken)
|
||||
if err != nil {
|
||||
ctx.Logger.Error("Failed to look up user based on cookie", "error", err)
|
||||
|
||||
var revokedErr *models.TokenRevokedError
|
||||
if !errors.As(err, &revokedErr) || !ctx.IsApiRequest() {
|
||||
cookies.WriteSessionCookie(ctx, h.Cfg, "", -1)
|
||||
}
|
||||
|
||||
ctx.Data["lookupTokenErr"] = err
|
||||
return false
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user