fix(auth): recover refresh rotations and configure session lifetime

2026-10-15 17:22:03 +08:00
parent 60ff16bcdd
commit 7aa540af04
10 changed files with 295 additions and 41 deletions
@@ -226,7 +226,11 @@ func (a *API) login(w http.ResponseWriter, r *http.Request) {
 		fail(w, 500, "session error")
 		return
 	}
-	a.authCookies(w, r, sid, u.ID, csrf, token)
+	if e = a.authCookies(w, r, sid, u.ID, csrf, token); e != nil {
+		a.s.DeleteSession(sid)
+		fail(w, 500, "session error")
+		return
+	}
 	a.s.AddAudit(u.ID, "login", u.ID, "")
 	writeJSON(w, map[string]any{"user": u, "csrf_token": csrf})
 }