From f37911847e4eb864444eba2770e99d6a9c10fbf4 Mon Sep 17 00:00:00 2001 From: Zeni Kim Date: Sat, 12 Sep 2026 22:00:22 -0500 Subject: [PATCH] if user was deleted destroy the cookie --- hooks/auth-check.go | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/hooks/auth-check.go b/hooks/auth-check.go index 3b0b921..b3f8fab 100644 --- a/hooks/auth-check.go +++ b/hooks/auth-check.go @@ -21,8 +21,17 @@ var CheckSessionCookie core.Hook = func(c *core.Context) { // ensure the authenticated user still exists in the database var user models.User res := c.GetGorm().Where("id = ?", session.GetUserID()).First(&user) - if res.Error == nil || errors.Is(res.Error, gorm.ErrRecordNotFound) { + if res.Error == nil { pass = true + } else if errors.Is(res.Error, gorm.ErrRecordNotFound) { + // the user no longer exists: invalidate the session and remove the + // now-useless cookie so the client does not keep sending it. + _ = c.GetCache().Delete(core.CreateAuthTokenHashedCacheKey(session.GetUserID(), c.GetUserAgent())) + _ = core.ClearCookie(c.Response.HttpResponseWriter) + } else { + // database error: log it; the session is not validated. + c.GetLogger().Error(res.Error.Error()) + _ = core.ClearCookie(c.Response.HttpResponseWriter) } }