goffee/cup
1
0
Fork 2
Code Issues Pull requests Projects Releases 17 Packages Wiki Activity Actions

if user was deleted destroy the cookie

Browse source
This commit is contained in:
Zeni Kim 2026-09-12 22:00:22 -05:00
parent 10ded026df
commit f37911847e
1 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
hooks/auth-check.go
View file

@ -21,8 +21,17 @@ var CheckSessionCookie core.Hook = func(c *core.Context) {
// ensure the authenticated user still exists in the database
var user models.User
res := c.GetGorm().Where("id = ?", session.GetUserID()).First(&user)
if res.Error == nil || errors.Is(res.Error, gorm.ErrRecordNotFound) {
if res.Error == nil {
pass = true
} else if errors.Is(res.Error, gorm.ErrRecordNotFound) {
// the user no longer exists: invalidate the session and remove the
// now-useless cookie so the client does not keep sending it.
_ = c.GetCache().Delete(core.CreateAuthTokenHashedCacheKey(session.GetUserID(), c.GetUserAgent()))
_ = core.ClearCookie(c.Response.HttpResponseWriter)
} else {
// database error: log it; the session is not validated.
c.GetLogger().Error(res.Error.Error())
_ = core.ClearCookie(c.Response.HttpResponseWriter)
}
}