Add missing nullptr check
In theory, having a sessionless websocket isn't possible. In practice,
this did come up when an ownership issue caused UB, which is how I saw
this.
Tested:
Tested with scripts/websocket_test.py and saw sensor values streaming by
as expected.
Signed-off-by: Ed Tanous <edtanous@google.com>
Change-Id: I7cc9c9660c8207ba857e6f6f14f010eaf79b73ef
diff --git a/http/websocket.hpp b/http/websocket.hpp
index 363076e..446db1b 100644
--- a/http/websocket.hpp
+++ b/http/websocket.hpp
@@ -100,14 +100,17 @@
boost::beast::websocket::response_type& m) {
#ifndef BMCWEB_INSECURE_DISABLE_CSRF_PREVENTION
- // use protocol for csrf checking
- if (session->cookieAuth &&
- !crow::utility::constantTimeStringCompare(
- protocol, session->csrfToken))
+ if (session != nullptr)
{
- BMCWEB_LOG_ERROR << "Websocket CSRF error";
- m.result(boost::beast::http::status::unauthorized);
- return;
+ // use protocol for csrf checking
+ if (session->cookieAuth &&
+ !crow::utility::constantTimeStringCompare(
+ protocol, session->csrfToken))
+ {
+ BMCWEB_LOG_ERROR << "Websocket CSRF error";
+ m.result(boost::beast::http::status::unauthorized);
+ return;
+ }
}
#endif
if (!protocol.empty())