Only enforce password-change invalidation for sessions that include a password fingerprint.

2026-06-23 00:27:44 -07:00
parent d4b6f3d25f
commit 9defe7e3e0
1 changed files with 2 additions and 1 deletions
@@ -41,7 +41,8 @@ export async function checkAuth(request: Request) {
    if (key?.userId) {
      user = await getUser(key.userId, { includePassword: true });

-      if (user && hash(user.password) !== key.pwd) {
+      // Only enforce password-change invalidation for sessions that include a password fingerprint.
+      if (user && key.pwd && hash(user.password) !== key.pwd) {
        user = null;
      }
    }