Revert "Allow session to reach auth handlers."

This reverts commit 4d0c094.

Author: RubenVerborgh

lib/create-app.js

@@ -168,7 +168,24 @@ function initWebId (argv, app, ldp) {
   // (for same-domain browsing by people only)
   const useSecureCookies = !!argv.sslKey // use secure cookies when over HTTPS
   const sessionHandler = session(sessionSettings(useSecureCookies, argv.host))
-  app.use(sessionHandler)
+  app.use((req, res, next) => {
+    sessionHandler(req, res, () => {
+      // Reject cookies from third-party applications.
+      // Otherwise, when a user is logged in to their Solid server,
+      // any third-party application could perform authenticated requests
+      // without permission by including the credentials set by the Solid server.
+      const origin = req.headers.origin
+      const userId = req.session.userId
+      if (!argv.host.allowsSessionFor(userId, origin)) {
+        debug(`Rejecting session for ${userId} from ${origin}`)
+        // Destroy session data
+        delete req.session.userId
+        // Ensure this modified session is not saved
+        req.session.save = (done) => done()
+      }
+      next()
+    })
+  })
 
   let accountManager = AccountManager.from({
     authMethod: argv.auth,
@@ -187,25 +204,6 @@ function initWebId (argv, app, ldp) {
   // Set up authentication-related API endpoints and app.locals
   initAuthentication(app, argv)
 
-  // Protect against requests from third-party applications
-  app.use((req, res, next) => {
-    // Reject cookies from third-party applications.
-    // Otherwise, when a user is logged in to their Solid server,
-    // any third-party application could perform authenticated requests
-    // without permission by including the credentials set by the Solid server.
-    const origin = req.headers.origin
-    const userId = req.session.userId
-    if (!argv.host.allowsSessionFor(userId, origin)) {
-      debug(`Rejecting session for ${userId} from ${origin}`)
-      // Destroy session data
-      delete req.session.userId
-      // Ensure this modified session is not saved
-      req.session.save = done => done()
-    }
-    next()
-  })
-
-  // Set up per-host LDP middleware
   if (argv.multiuser) {
     app.use(vhost('*', LdpMiddleware(corsSettings)))
   }