if user was deleted destroy the cookie

hooks/auth-check.go

@@ -21,8 +21,17 @@ var CheckSessionCookie core.Hook = func(c *core.Context) {
 		// ensure the authenticated user still exists in the database
 		var user models.User
 		res := c.GetGorm().Where("id = ?", session.GetUserID()).First(&user)
-		if res.Error == nil || errors.Is(res.Error, gorm.ErrRecordNotFound) {
+		if res.Error == nil {
 			pass = true
+		} else if errors.Is(res.Error, gorm.ErrRecordNotFound) {
+			// the user no longer exists: invalidate the session and remove the
+			// now-useless cookie so the client does not keep sending it.
+			_ = c.GetCache().Delete(core.CreateAuthTokenHashedCacheKey(session.GetUserID(), c.GetUserAgent()))
+			_ = core.ClearCookie(c.Response.HttpResponseWriter)
+		} else {
+			// database error: log it; the session is not validated.
+			c.GetLogger().Error(res.Error.Error())
+			_ = core.ClearCookie(c.Response.HttpResponseWriter)
 		}
 	}