mirror of
https://github.com/discourse/discourse.git
synced 2026-08-08 20:18:23 -05:00
FIX: Strip discourse-logged-in header during force_anonymous! (#14533)
When the anonymous cache forces users into anonymous mode, it strips the cookies from their request. However, the discourse-logged-in header from the JS client remained. When the discourse-logged-in header is present without any valid auth_token, the current_user_provider [marks the request as ['logged out'](https://github.com/discourse/discourse/blob/dbbfad7ed07c47674f9dee4ac7021ca51cc04e2e/lib/auth/default_current_user_provider.rb#L125-L125), and a [discourse-logged-out header is returned to the client](https://github.com/discourse/discourse/blob/dbbfad7ed07c47674f9dee4ac7021ca51cc04e2e/lib/middleware/request_tracker.rb#L209-L211). This causes the JS app to [popup a "you were logged out" modal](https://github.com/discourse/discourse/blob/dbbfad7ed07c47674f9dee4ac7021ca51cc04e2e/app/assets/javascripts/discourse/app/components/d-document.js#L29-L29), which is very disruptive. This commit strips the discourse-logged-in header from the request at the same time as the auth cookie.
This commit is contained in:
@@ -171,6 +171,7 @@ module Middleware
|
||||
def force_anonymous!
|
||||
@env[Auth::DefaultCurrentUserProvider::USER_API_KEY] = nil
|
||||
@env['HTTP_COOKIE'] = nil
|
||||
@env['HTTP_DISCOURSE_LOGGED_IN'] = nil
|
||||
@env['rack.request.cookie.hash'] = {}
|
||||
@env['rack.request.cookie.string'] = ''
|
||||
@env['_bypass_cache'] = nil
|
||||
|
||||
Reference in New Issue
Block a user