volatiletech
Clear cookie and redirect to login page when cookie expired instead of returning 500?
It is reasonable behavior for the cookie expired user to login again. rather than see a 500 page?
See my comment to your comment about the behavior of your Cookie/Session storers.
Hi @aarondl
Yes, do not return error on LoadClientState is a working approach. but it is more like the middleware's responsibility to handle the error. I'm thinking of doing something like
func (a *Authboss) LoadClientStateMiddleware(h http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
writer := a.NewResponse(w)
request, err := a.LoadClientState(writer, r)
if err != nil {
logger := a.RequestLogger(r)
logger.Errorf("failed to load client state %+v", err)
DelAllSession(w, []string{})
http.Redirect(w, r, a.Paths.LogoutOk, http.StatusUnauthorized)
}
h.ServeHTTP(writer, request)
})
}
Or even more, we can define a callback function, like OnCookieError and invoke it here.
anyway, I think an appropriate way is to delete cookie and redirect to login page with some text like “your login credential is out-of-date, please login again“. What do you think?