Appwrite: Login with blocked Account breaks all following Requests

[RingoRohe]

🐛 Bug Report

Everything is fine until I try to create a session for a blocked User. When I try, I get a "201 Created" Response and a Cookie is set. But because the User is blocked, every following request to the Accounts Endpoint results in a "401 Unauthorized" Response. Even the deleteSession Request. I cant even login to the Appwrite Backend until I manually remove all Cookies and clear the Cache.

To me it looks like something is wrong with Cookie mechanics for blocked Users. (there should no cookie get set when a blocked user tries to login, right?)

Tested and reproduced multiple times with Playground for JS and an Appwrite Server v0.6.2 in a Docker Container.

Have you spent some time to check if this issue has been raised before?

At the Appwrite Discord Support Channel we tried to figure out what could be the Problem on my side and decided to open an Issue.

To Reproduce

• create a new Project in Appwrite Backend
• clone and install Playground for JS and set it up for the just created project
• create at least 2 user accounts with the playground
• for testing: log in and out a few times with both accounts
• block one of the users in the appwrite backend
• open the network tab in your development tools in the browser to see whats happening
• log in with the blocked user - you will get a 201 created response
• click on "Get User Email" or "Get User Name": you will see a 401 unauthorized
• click on "Delete All Sessions": 401 unauthorized
• try to log in with the not blocked user: 401
• reload the appwrite backend page: 401

To get out of this state and be able to login again, you have to manually delete the Appwrite Cookies (and maybe the local storage but i'm not sure here)

Expected behavior

Trying to login a blocked account shold not result in a 201 created session and not set a cookie.

Actual Behavior

As described above.

Your Environment

• Appwrite Server v0.6.2 in a Docker Container serving at localhost:1234
• Playground for JS serving localhost:8000

If needed I can provide requests/responses as HAR files.

[eldadfux]

Thanks for reporting this issue @RingoRohe. I've started working on a fix on this branch: https://github.com/appwrite/appwrite/tree/bug-777-blocked-users-can-create-sessions - I have to add a couple of tests and then I'll submit a PR.

[eldadfux]

Change tested, reviewed and merged to 0.7.x

[eldadfux]

Version 0.7 is out with the fix 🚀