Aug 20, 2025 · Aug 19, 2025 · Aug 19, 2025 · Aug 20, 2025 · Aug 20, 2025 · Aug 20, 2025
diff --git a/coderd/coderd.go b/coderd/coderd.go
 r.Post("/first", api.postFirstUser)
 r.Get("/authmethods", api.userAuthMethods)

 r.Group(func(r chi.Router) {
 r.Use(apiKeyMiddlewareOptional)
 r.Post("/logout", api.postLogout)
 })

 r.Group(func(r chi.Router) {
 // We use a tight limit for password login to protect against
 // audit-log write DoS, pbkdf2 DoS, and simple brute-force
 )
 r.Post("/", api.postUser)
 r.Get("/", api.users)
 r.Post("/logout", api.postLogout)
 // These routes query information about site wide roles.
 r.Route("/roles", func(r chi.Router) {
 r.Get("/", api.AssignableSiteRoles)
diff --git a/coderd/userauth.go b/coderd/userauth.go
 http.SetCookie(rw, cookie)

 // Delete the session token from database.
 apiKey, ok := httpmw.APIKeyOptional(r)
 if !ok {
 httpapi.Write(ctx, rw, http.StatusOK, codersdk.Response{
 Message: "Not authenticated",
 })
 return
 }

 apiKey := httpmw.APIKey(r)
 aReq.Old = apiKey

 logger := api.Logger.Named(userAuthLoggerName)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1225,11 +1225,6 @@ func New(options Options) API {
		r.Post("/first", api.postFirstUser)
		r.Get("/authmethods", api.userAuthMethods)

		r.Group(func(r chi.Router) {
		r.Use(apiKeyMiddlewareOptional)
		r.Post("/logout", api.postLogout)
		})

		r.Group(func(r chi.Router) {
		// We use a tight limit for password login to protect against
		// audit-log write DoS, pbkdf2 DoS, and simple brute-force
Expand DownExpand Up		@@ -1263,6 +1258,7 @@ func New(options Options) API {
		)
		r.Post("/", api.postUser)
		r.Get("/", api.users)
		r.Post("/logout", api.postLogout)
		// These routes query information about site wide roles.
		r.Route("/roles", func(r chi.Router) {
		r.Get("/", api.AssignableSiteRoles)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -708,14 +708,7 @@ func (api API) postLogout(rw http.ResponseWriter, r http.Request) {
		http.SetCookie(rw, cookie)

		// Delete the session token from database.
		apiKey, ok := httpmw.APIKeyOptional(r)
		if !ok {
		httpapi.Write(ctx, rw, http.StatusOK, codersdk.Response{
		Message: "Not authenticated",
		})
		return
		}

		apiKey := httpmw.APIKey(r)
		aReq.Old = apiKey

		logger := api.Logger.Named(userAuthLoggerName)
Expand Down