diff options
Diffstat (limited to 'routers/user')
| -rw-r--r-- | routers/user/auth.go | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/routers/user/auth.go b/routers/user/auth.go index 3af87c58..646b8783 100644 --- a/routers/user/auth.go +++ b/routers/user/auth.go @@ -63,6 +63,7 @@ func AutoSignIn(ctx *context.Context) (bool, error) { isSucceed = true ctx.Session.Set("uid", u.Id) ctx.Session.Set("uname", u.Name) + ctx.SetCookie(setting.CSRFCookieName, "", -1, setting.AppSubUrl) return true, nil } @@ -116,6 +117,10 @@ func SignInPost(ctx *context.Context, form auth.SignInForm) { ctx.Session.Set("uid", u.Id) ctx.Session.Set("uname", u.Name) + + // Clear whatever CSRF has right now, force to generate a new one + ctx.SetCookie(setting.CSRFCookieName, "", -1, setting.AppSubUrl) + if redirectTo, _ := url.QueryUnescape(ctx.GetCookie("redirect_to")); len(redirectTo) > 0 { ctx.SetCookie("redirect_to", "", -1, setting.AppSubUrl) ctx.Redirect(redirectTo) @@ -133,6 +138,7 @@ func SignOut(ctx *context.Context) { ctx.Session.Delete("socialEmail") ctx.SetCookie(setting.CookieUserName, "", -1, setting.AppSubUrl) ctx.SetCookie(setting.CookieRememberName, "", -1, setting.AppSubUrl) + ctx.SetCookie(setting.CSRFCookieName, "", -1, setting.AppSubUrl) ctx.Redirect(setting.AppSubUrl + "/") } |