Return unauthorized if header auth is the only one

2026-02-10 20:02:26 +00:00 · 2025-10-13 15:20:04 -07:00
parent 6664efaa13
commit 48af91c976
2 changed files with 6 additions and 1 deletions
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -314,6 +314,11 @@ export async function verifyResourceSession(
                logger.debug("Resource allowed because header auth is valid");
                return allowed(res);
            }
+
+            // if there are no other auth methods we need to return unauthorized here
+            if (!sso && !pincode && !password && !resource.emailWhitelistEnabled) {
+                return notAllowed(res);
+            }
        }

        if (!sessions) {