From 3967594b798b04684db3f4fcc85a9de7dec2ce76 Mon Sep 17 00:00:00 2001
From: Michael Geers <michael@geers.tv>
Date: Mon, 6 Apr 2026 16:18:08 +0200
Subject: [PATCH] Fix auth handler race condition (#28864)

---
 server/http_auth.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server/http_auth.go b/server/http_auth.go
index 537f1bb14..4b89a8f26 100644
--- a/server/http_auth.go
+++ b/server/http_auth.go
@@ -164,6 +164,11 @@ func logoutHandler(w http.ResponseWriter, r *http.Request) {
 func ensureAuthHandler(authObject auth.Auth) mux.MiddlewareFunc {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if next == nil {
+				http.Error(w, "Not Found", http.StatusNotFound)
+				return
+			}
+
 			if authObject.GetAuthMode() == auth.Disabled {
 				next.ServeHTTP(w, r)
 				return