challenges: return ErrNoCookie when no cookies of given name are present

2025-05-03 17:41:50 +02:00
parent 76417b4308
commit 925a1d59a2
1 changed files with 5 additions and 1 deletions
--- a/lib/challenge/data.go
+++ b/lib/challenge/data.go
@@ -433,7 +433,11 @@ func (d *RequestData) verifyChallengeStateCookie(cookie *http.Cookie) (TokenChal
 }

 func (d *RequestData) verifyChallengeState() (state TokenChallengeMap, err error) {
-	for _, cookie := range d.r.CookiesNamed(d.cookieName) {
+	cookies := d.r.CookiesNamed(d.cookieName)
+	if len(cookies) == 0 {
+		return nil, http.ErrNoCookie
+	}
+	for _, cookie := range cookies {
 		state, err = d.verifyChallengeStateCookie(cookie)
 		if err == nil {
 			return state, nil