don't verify empty cookies

1 files changed, 3 insertions, 1 deletions

diff --git a/api/auth.go b/api/auth.go
index dcddf5a..0294edd 100644
--- a/api/auth.go
+++ b/api/auth.go
@@ -169,7 +169,7 @@ func VerifySessionContinuation(context *RequestContext, req *http.Request, resp
 		user, userErr := getUserFromAuthHeader(context.DBConn, authHeader)
 
 		sessionCookie, err := req.Cookie("session")
-		if err == nil {
+		if err == nil && sessionCookie.Value != "" {
 			user, userErr = getUserFromSession(context.DBConn, sessionCookie.Value)
 		}
 
@@ -180,6 +180,8 @@ func VerifySessionContinuation(context *RequestContext, req *http.Request, resp
 				Name:   "session",
 				MaxAge: 0, // reset session cookie in case
 			})
+
+			context.User = nil
 			return failure(context, req, resp)
 		}