Allow legacy stateless tokens that were minted without a password fingerprint.

2026-06-23 13:24:55 -07:00
parent 3b792720af
commit 3888ec6f4f
2 changed files with 11 additions and 1 deletions
@@ -32,7 +32,8 @@ export async function checkAuth(request: Request) {
    user = await getUser(userId, { includePassword: true });

    // Reject tokens issued before the current password.
-    if (user && hash(user.password) !== payload.pwd) {
+    // Allow legacy stateless tokens that were minted without a password fingerprint.
+    if (user && payload.pwd && hash(user.password) !== payload.pwd) {
      user = null;
    }
  } else if (redis.enabled && authKey) {