From 12423737d5bb27d9cd18c8988996afdf1867d6c4 Mon Sep 17 00:00:00 2001 From: Stefan Majoor Date: Thu, 22 Oct 2026 10:53:06 +0200 Subject: [PATCH 1/2] Add failing test that shows that an inactive user does not get a 403 but a 200 error instead --- tests/plugins/test_token_auth.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/plugins/test_token_auth.py b/tests/plugins/test_token_auth.py index f1ad5c16..4505a144 100644 --- a/tests/plugins/test_token_auth.py +++ b/tests/plugins/test_token_auth.py @@ -57,6 +57,14 @@ def test_token_expired(self): EXTRA(): None, }) + def test_deactivated_user_token_auth(self): + # A deactivated user should not be able to authenticate with a token. + self.user.is_active = False + self.user.save() + + res = self.client.get('/user/identify/') + self.assertEqual(res.status_code, 404) + def test_token_not_found(self): old_token = self.token.token self.token.token = 'foo' From d83c52a1d3397356345c839fc8ab5fc6852619df Mon Sep 17 00:00:00 2001 From: Stefan Majoor Date: Thu, 22 Oct 2026 10:57:32 +0200 Subject: [PATCH 2/2] Fix that doesn't allow tokens for users that are inactive to be used --- binder/plugins/token_auth/middleware.py | 2 +- changelog/CRTX-969 | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 changelog/CRTX-969 diff --git a/binder/plugins/token_auth/middleware.py b/binder/plugins/token_auth/middleware.py index 530b6125..0c6eb0c8 100644 --- a/binder/plugins/token_auth/middleware.py +++ b/binder/plugins/token_auth/middleware.py @@ -81,7 +81,7 @@ def __call__(self, request): return self.get_response(request) try: - token = Token.objects.get(token=token) + token = Token.objects.get(token=token, user__is_active=True) except Token.DoesNotExist: # Token does not exist # Raise and catch needed to provide location diff --git a/changelog/CRTX-969 b/changelog/CRTX-969 new file mode 100644 index 00000000..64f2c3b1 --- /dev/null +++ b/changelog/CRTX-969 @@ -0,0 +1 @@ +- [CRTX-969] Fix issue where tokens for deleted users are still valid