From 849b00a4526d73174f8437284188c55b7b8cbb90 Mon Sep 17 00:00:00 2001 From: Umputun Date: Sun, 13 May 2018 13:05:50 -0500 Subject: [PATCH] don't restrict xsrfError check for requires auth path only --- app/rest/auth/auth.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/rest/auth/auth.go b/app/rest/auth/auth.go index c80dc033..b9ca39d1 100644 --- a/app/rest/auth/auth.go +++ b/app/rest/auth/auth.go @@ -64,7 +64,7 @@ func (a *Authenticator) Auth(reqAuth bool) func(http.Handler) http.Handler { xsrfError := func() error { xsrfToken := r.Header.Get("X-XSRF-TOKEN") sessionToken, headerOk := session.Values["xsrf_token"] - if (xsrfToken == "" || sessionToken == nil || !headerOk) && reqAuth { + if !headerOk || xsrfToken == "" || sessionToken == nil { return errors.New(" no xsrf_token in session") }