fix(continuity): remove cookie on any error

ory · Jan 5, 2022 · 428ac03 · 428ac03
1 parent ef4b01a
commit 428ac03
Showing 1 changed file with 8 additions and 8 deletions.
diff --git a/continuity/manager_cookie.go b/continuity/manager_cookie.go
@@ -61,10 +61,8 @@ func (m *ManagerCookie) Pause(ctx context.Context, w http.ResponseWriter, r *htt
 }
 
 func (m *ManagerCookie) Continue(ctx context.Context, w http.ResponseWriter, r *http.Request, name string, opts ...ManagerOption) (*Container, error) {
-	container, err := m.container(ctx, r, name)
+	container, err := m.container(ctx, w, r, name)
 	if err != nil {
-		// We do not care about an error here
-		_ = x.SessionUnsetKey(w, r, m.d.ContinuityCookieManager(ctx), cookieName, name)
 		return nil, err
 	}
 
@@ -94,25 +92,28 @@ func (m *ManagerCookie) Continue(ctx context.Context, w http.ResponseWriter, r *
 	return container, nil
 }
 
-func (m *ManagerCookie) sid(ctx context.Context, r *http.Request, name string) (uuid.UUID, error) {
+func (m *ManagerCookie) sid(ctx context.Context, w http.ResponseWriter, r *http.Request, name string) (uuid.UUID, error) {
 	var sid uuid.UUID
 	if s, err := x.SessionGetString(r, m.d.ContinuityCookieManager(ctx), cookieName, name); err != nil {
+		_ = x.SessionUnsetKey(w, r, m.d.ContinuityCookieManager(ctx), cookieName, name)
 		return sid, errors.WithStack(ErrNotResumable.WithDebugf("%+v", err))
 	} else if sid = x.ParseUUID(s); sid == uuid.Nil {
+		_ = x.SessionUnsetKey(w, r, m.d.ContinuityCookieManager(ctx), cookieName, name)
 		return sid, errors.WithStack(ErrNotResumable.WithDebug("session id is not a valid uuid"))
 	}
 
 	return sid, nil
 }
 
-func (m *ManagerCookie) container(ctx context.Context, r *http.Request, name string) (*Container, error) {
-	sid, err := m.sid(ctx, r, name)
+func (m *ManagerCookie) container(ctx context.Context, w http.ResponseWriter, r *http.Request, name string) (*Container, error) {
+	sid, err := m.sid(ctx, w, r, name)
 	if err != nil {
 		return nil, err
 	}
 
 	container, err := m.d.ContinuityPersister().GetContinuitySession(ctx, sid)
 	if errors.Is(err, sqlcon.ErrNoRows) {
+		_ = x.SessionUnsetKey(w, r, m.d.ContinuityCookieManager(ctx), cookieName, name)
 		return nil, errors.WithStack(ErrNotResumable.WithDebugf("Resumable ID from cookie could not be found in the datastore: %+v", err))
 	} else if err != nil {
 		return nil, err
@@ -122,10 +123,9 @@ func (m *ManagerCookie) container(ctx context.Context, r *http.Request, name str
 }
 
 func (m ManagerCookie) Abort(ctx context.Context, w http.ResponseWriter, r *http.Request, name string) error {
-	sid, err := m.sid(ctx, r, name)
+	sid, err := m.sid(ctx, w, r, name)
 	if errors.Is(err, &ErrNotResumable) {
 		// We do not care about an error here
-		_ = x.SessionUnsetKey(w, r, m.d.ContinuityCookieManager(ctx), cookieName, name)
 		return nil
 	} else if err != nil {
 		return err