From 3ec33123b21ea174caf41a3ba6b1f536cb2085ea Mon Sep 17 00:00:00 2001 From: Aleksandre Date: Sat, 23 Aug 2025 00:32:39 +0400 Subject: [PATCH] Skips token validation for auth routes Exempts login, token refresh, and logout endpoints from standard access token validation. These routes either don't carry an access token or handle session management in a way that bypasses this specific validation. --- api/internal/server/middleware/token/token.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/api/internal/server/middleware/token/token.go b/api/internal/server/middleware/token/token.go index 293293c..5063884 100644 --- a/api/internal/server/middleware/token/token.go +++ b/api/internal/server/middleware/token/token.go @@ -15,6 +15,12 @@ import ( func SetClaimsFromToken() gin.HandlerFunc { return func(c *gin.Context) { + path := c.Request.URL.Path + if path == "/api/user/refresh" || path == "/api/user/logout" || path == "/api/user/login" { + c.Next() + return + } + tokenString, err := ExtractToken(c) if err != nil { c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{