Update dependency vapor/vapor to from: "4.121.1"

[renovate]

This PR contains the following updates:

Package	Update	Change
vapor/vapor	patch	from: "4.121.0" → from: "4.121.1"

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

vapor/vapor (vapor/vapor)

v4.121.1: - Do not create a session if no cookie was provided

Compare Source

What's Changed

Do not create a session if no cookie was provided by @​czechboy0 in #​3372

Summary

When using SessionsMiddleware and a custom AsyncSessionAuthenticator together, we were seeing that even in cases when no cookie is provided in the request, and no error was thrown by e.g. a guard middleware or the handler, we were still seeing a set-cookie header in the response, which isn’t desired.

This lead to many sessions created in the sessions driver for calls that didn’t require authentication, nor did it provide any.

This seemed to be a side effect of the way AsyncSessionAuthenticator checked if the session already contained an authenticated value - by using the getter request.session, a session was created lazily.

The fix is to prepend a check to request.hasSession and only using request.session... if one indeed exists.

Test Plan

A regression test was added which exercises this scenario - and it fails without the fix.

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.121.0...4.121.1

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.