{"action":"created","issue":{"url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/120","repository_url":"https://api.github.com/repos/hapijs/hapi-auth-cookie","labels_url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/120/labels{/name}","comments_url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/120/comments","events_url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/120/events","html_url":"https://github.com/hapijs/hapi-auth-cookie/issues/120","id":137844727,"number":120,"title":"Auth mode 'optional' does not distinguish between the lack of a session cookie and an invalid session cookie","user":{"login":"dardyfella","id":542587,"avatar_url":"https://avatars.githubusercontent.com/u/542587?v=3","gravatar_id":"","url":"https://api.github.com/users/dardyfella","html_url":"https://github.com/dardyfella","followers_url":"https://api.github.com/users/dardyfella/followers","following_url":"https://api.github.com/users/dardyfella/following{/other_user}","gists_url":"https://api.github.com/users/dardyfella/gists{/gist_id}","starred_url":"https://api.github.com/users/dardyfella/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dardyfella/subscriptions","organizations_url":"https://api.github.com/users/dardyfella/orgs","repos_url":"https://api.github.com/users/dardyfella/repos","events_url":"https://api.github.com/users/dardyfella/events{/privacy}","received_events_url":"https://api.github.com/users/dardyfella/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/labels/discussion","name":"discussion","color":"d4c5f9"},{"url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/labels/enhancement","name":"enhancement","color":"207de5"}],"state":"open","locked":false,"assignee":{"login":"jaw187","id":885557,"avatar_url":"https://avatars.githubusercontent.com/u/885557?v=3","gravatar_id":"","url":"https://api.github.com/users/jaw187","html_url":"https://github.com/jaw187","followers_url":"https://api.github.com/users/jaw187/followers","following_url":"https://api.github.com/users/jaw187/following{/other_user}","gists_url":"https://api.github.com/users/jaw187/gists{/gist_id}","starred_url":"https://api.github.com/users/jaw187/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaw187/subscriptions","organizations_url":"https://api.github.com/users/jaw187/orgs","repos_url":"https://api.github.com/users/jaw187/repos","events_url":"https://api.github.com/users/jaw187/events{/privacy}","received_events_url":"https://api.github.com/users/jaw187/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2016-03-02T11:14:08Z","updated_at":"2016-04-18T10:31:39Z","closed_at":null,"body":"I've noticed that when a route is configured with auth: { mode: 'optional' }, hapi-auth-cookie doesn't distinguish between the lack of a session cookie and an invalid session cookie.\r\n\r\n\r\nFor example, both of the following GET requests will return HTTP status code 200 and hit the route handler when ran against the example code [here](http://pastebin.com/nJ26UYZz):\r\n\r\n`\r\ncurl http://127.0.0.1:8000/\r\ncurl http://127.0.0.1:8000/ -H 'Cookie: sid-example=badcookie'\r\n`\r\n\r\nFurthermore, if the / route is configured with plugins: { 'hapi-auth-cookie': { redirectTo: '/login' } } instead in the above example code, both of those GET requests will return HTTP status code 302 and get redirected to /login.\r\n\r\nhapi-auth-cookie should reject requests with bad cookies when redirectTo is set to false and not redirect requests that have no cookies when redirectTo is set to a path-like string."},"comment":{"url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/comments/211320264","html_url":"https://github.com/hapijs/hapi-auth-cookie/issues/120#issuecomment-211320264","issue_url":"https://api.github.com/repos/hapijs/hapi-auth-cookie/issues/120","id":211320264,"user":{"login":"dardyfella","id":542587,"avatar_url":"https://avatars.githubusercontent.com/u/542587?v=3","gravatar_id":"","url":"https://api.github.com/users/dardyfella","html_url":"https://github.com/dardyfella","followers_url":"https://api.github.com/users/dardyfella/followers","following_url":"https://api.github.com/users/dardyfella/following{/other_user}","gists_url":"https://api.github.com/users/dardyfella/gists{/gist_id}","starred_url":"https://api.github.com/users/dardyfella/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dardyfella/subscriptions","organizations_url":"https://api.github.com/users/dardyfella/orgs","repos_url":"https://api.github.com/users/dardyfella/repos","events_url":"https://api.github.com/users/dardyfella/events{/privacy}","received_events_url":"https://api.github.com/users/dardyfella/received_events","type":"User","site_admin":false},"created_at":"2016-04-18T10:31:38Z","updated_at":"2016-04-18T10:31:38Z","body":"@jaw187 No worries man. When I was looking around at the various hapi authentication plugins I found a similar request for [hapi-auth-jwt2](https://github.com/dwyl/hapi-auth-jwt2/issues/43)"}}