From f9ad268ff237c0ce6d89d0e81fb2a60e511c1b1c Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Tue, 9 Apr 2024 12:20:14 +0200
Subject: [PATCH] app-backend: log users out if session is invalid

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 plugins/app-backend/src/service/router.ts | 26 ++++++++++++++++-------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/plugins/app-backend/src/service/router.ts b/plugins/app-backend/src/service/router.ts
index ce94720a9a..f58091f762 100644
--- a/plugins/app-backend/src/service/router.ts
+++ b/plugins/app-backend/src/service/router.ts
@@ -177,16 +177,26 @@ export async function createRouter(
 
     const publicRouter = Router();
 
-    publicRouter.use(async (req, _res, next) => {
-      const credentials = await httpAuth.credentials(req, {
-        allow: ['user', 'service', 'none'],
-        allowLimitedAccess: true,
-      });
+    publicRouter.use(async (req, res, next) => {
+      try {
+        const credentials = await httpAuth.credentials(req, {
+          allow: ['user', 'service', 'none'],
+          allowLimitedAccess: true,
+        });
 
-      if (credentials.principal.type === 'none') {
+        if (credentials.principal.type === 'none') {
+          next();
+        } else {
+          next('router');
+        }
+      } catch {
+        // If we fail to authenticate, make sure the session cookie is cleared
+        // and continue as unauthenticated. If the user is logged in they will
+        // immediately be redirected back to the protected app via the POST.
+        await httpAuth.issueUserCookie(res, {
+          credentials: await auth.getNoneCredentials(),
+        });
         next();
-      } else {
-        next('router');
       }
     });