From b109d6514e5f7569f0c7ef16fa561ed21d084604 Mon Sep 17 00:00:00 2001 From: Misi Date: Mon, 22 May 2023 14:16:25 +0200 Subject: [PATCH] [v9.2.x] Auth: Remove the session cookie only if it's invalid or revoked (#68795) Auth: Remove the session cookie only if it's invalid or revoked (#65984) Remove the cookie if it's invalid or revoked (cherry picked from commit 4cac95d1c22cc553723ceb72218b3167b8d13dcf) --- pkg/services/contexthandler/contexthandler.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/services/contexthandler/contexthandler.go b/pkg/services/contexthandler/contexthandler.go index 5febc3e9104..867c54cf2dc 100644 --- a/pkg/services/contexthandler/contexthandler.go +++ b/pkg/services/contexthandler/contexthandler.go @@ -434,8 +434,8 @@ func (h *ContextHandler) initContextWithToken(reqContext *models.ReqContext, org token, err := h.AuthTokenService.LookupToken(ctx, rawToken) if err != nil { reqContext.Logger.Warn("failed to look up session from cookie", "error", err) - if errors.Is(err, models.ErrUserTokenNotFound) || errors.Is(err, models.ErrInvalidSessionToken) { - // Burn the cookie in case of invalid, expired or missing token + if errors.Is(err, models.ErrInvalidSessionToken) { + // Burn the cookie in case of invalid or revoked token reqContext.Resp.Before(h.deleteInvalidCookieEndOfRequestFunc(reqContext)) }