From 782c73b6944ec64fa751eb2628528dc0f51167db Mon Sep 17 00:00:00 2001 From: Misi Date: Mon, 22 May 2023 14:16:59 +0200 Subject: [PATCH] [v9.3.x] Auth: Remove the session cookie only if it's invalid or revoked (#68796) Auth: Remove the session cookie only if it's invalid or revoked (#65984) Remove the cookie if it's invalid or revoked (cherry picked from commit 4cac95d1c22cc553723ceb72218b3167b8d13dcf) --- pkg/services/contexthandler/contexthandler.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/services/contexthandler/contexthandler.go b/pkg/services/contexthandler/contexthandler.go index f0c8190819f..614b379dc19 100644 --- a/pkg/services/contexthandler/contexthandler.go +++ b/pkg/services/contexthandler/contexthandler.go @@ -451,8 +451,8 @@ func (h *ContextHandler) initContextWithToken(reqContext *models.ReqContext, org token, err := h.AuthTokenService.LookupToken(ctx, rawToken) if err != nil { reqContext.Logger.Warn("failed to look up session from cookie", "error", err) - if errors.Is(err, models.ErrUserTokenNotFound) || errors.Is(err, models.ErrInvalidSessionToken) { - // Burn the cookie in case of invalid, expired or missing token + if errors.Is(err, models.ErrInvalidSessionToken) { + // Burn the cookie in case of invalid or revoked token reqContext.Resp.Before(h.deleteInvalidCookieEndOfRequestFunc(reqContext)) }