crystal is confusing

iv-org · Oct 30, 2024 · cd36c49 · cd36c49
1 parent 75b49d4
commit cd36c49
Showing 1 changed file with 9 additions and 4 deletions.
diff --git a/src/invidious/routes/api/v1/authenticated.cr b/src/invidious/routes/api/v1/authenticated.cr
@@ -420,11 +420,16 @@ module Invidious::Routes::API::V1::Authenticated
       callback_url = URI.parse(callback_url)
     end
 
-    if sid = env.get?("sid").try &.as(String) && content_type != "application/json"
-      env.response.content_type = "text/html"
+    if content_type != "application/json"
+      if sid = env.get?("sid").try &.as(String)
+        env.response.content_type = "text/html"
 
-      csrf_token = generate_response(sid, {":authorize_token"}, HMAC_KEY, use_nonce: true)
-      return templated "user/authorize_token"
+        csrf_token = generate_response(sid, {":authorize_token"}, HMAC_KEY, use_nonce: true)
+        return templated "user/authorize_token"
+      else
+        # is it enough?
+        env.response.status_code = 403
+      end
     else
       env.response.content_type = "application/json"