fix: do not set vary cookie if something bypassed session

android-com-pl · Jan 30, 2024 · 42949da · 42949da
1 parent 0484edb
commit 42949da
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/Middleware/VaryCookieMiddleware.php b/src/Middleware/VaryCookieMiddleware.php
@@ -48,8 +48,12 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
         return $this->withVaryCookie($response, $session);
     }
 
-    private function withVaryCookie(Response $response, Session $session): Response
+    private function withVaryCookie(Response $response, ?Session $session): Response
     {
+        if (! $session) {
+            return $response;
+        }
+
         return FigResponseCookies::set(
             $response,
             $this->cookie->make(LSCache::VARY_COOKIE, $session->token(), $this->session['lifetime'] * 60)