mrhid6
2f60b81962
sessionFromCookie already writes "session expired" when a cookie was presented and rejected with no bearer to fall through to. Middleware called sessionFromToken anyway, which wrote a second "not authenticated" body onto the same response for every ordinary browser-session timeout - gin logged "superfluous response.WriteHeader call" on ordinary use, not a rare edge case. Guard on c.IsAborted() after sessionFromCookie: true only in that one rejected-cookie-no-bearer branch, so it short-circuits there while the other three credential paths (no credential, bearer only, stale cookie plus valid bearer) are unaffected.