From 2f60b81962b2f665e26a0b130086554356794207 Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Wed, 12 Aug 2026 14:35:20 +0000 Subject: [PATCH] fix: Stop the session middleware writing two responses on an expired cookie sessionFromCookie already writes "session expired" when a cookie was presented and rejected with no bearer to fall through to. Middleware called sessionFromToken anyway, which wrote a second "not authenticated" body onto the same response for every ordinary browser-session timeout - gin logged "superfluous response.WriteHeader call" on ordinary use, not a rare edge case. Guard on c.IsAborted() after sessionFromCookie: true only in that one rejected-cookie-no-bearer branch, so it short-circuits there while the other three credential paths (no credential, bearer only, stale cookie plus valid bearer) are unaffected. --- server/internal/auth/middleware.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/server/internal/auth/middleware.go b/server/internal/auth/middleware.go index d50836f..e17acc3 100644 --- a/server/internal/auth/middleware.go +++ b/server/internal/auth/middleware.go @@ -61,6 +61,13 @@ func Middleware() gin.HandlerFunc { return func(c *gin.Context) { sess, ok := sessionFromCookie(c) if !ok { + // A cookie that was presented and rejected has already had its + // response written by sessionFromCookie (no bearer was present to + // fall through to). Trying sessionFromToken anyway would write a + // second body onto the same response. + if c.IsAborted() { + return + } sess, ok = sessionFromToken(c) } if !ok {