Fix unauthorized session termination (#30)

2024-06-20 22:35:30 +07:00
parent fd2a7d110a
commit f63c4f7928
3 changed files with 41 additions and 39 deletions
--- a/handler/user/session/terminate/terminate.go
+++ b/handler/user/session/terminate/terminate.go
@ -11,10 +11,14 @@ func DELETE(w http.ResponseWriter, r *http.Request) {

 	_, mySession, _ := session.GetSession(r)
 	otherSession, _ := session.Get(id)
+	if session.GetSessionInfo(mySession.Email, otherSession.ID) == nil {
+		w.WriteHeader(http.StatusUnauthorized)
+		return
+	}
 	otherSession.Delete()
 	session.RemoveSessionInfo(mySession.Email, otherSession.ID)
-
 	component := userView.SessionTable(session.GetSessions(mySession.Email))
+
 	err := component.Render(r.Context(), w)
 	if err != nil {
 		w.WriteHeader(http.StatusInternalServerError)