Ensure user cookie can be unencoded (#6937)

* Ensure user cookie can be unencoded * Skip decoding without secret
holoviz · Jun 25, 2024 · 497370d · 497370d
1 parent 4e351ed
commit 497370d
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/panel/io/application.py b/panel/io/application.py
@@ -98,9 +98,12 @@ def process_request(self, request) -> dict[str, Any]:
         '''
         request_data = super().process_request(request)
         user = request.cookies.get('user')
-        if user:
+        if user and config.cookie_secret:
             from tornado.web import decode_signed_value
-            user = decode_signed_value(config.cookie_secret, 'user', user.value).decode('utf-8')
+            try:
+                user = decode_signed_value(config.cookie_secret, 'user', user.value).decode('utf-8')
+            except Exception:
+                user = user.value
             if user in state._oauth_user_overrides:
                 user_data = json.dumps(state._oauth_user_overrides[user])
                 if state.encryption: