fix: SEC16

CHANGELOG.md

@@ -4,9 +4,9 @@
 
 - Fixed a bug that caused the server to drop events during processing if several events for the same room were sent in a
   singular transaction. Contributed by @nex. (#1711)
-- Fixed a bug that caused the server to panic while handling transactions with malformed events, resulting in a 
+- Fixed a bug that caused the server to panic while handling transactions with malformed events, resulting in a
   deadlock that prevented the remote server from federating with us until the server was restarted. Contributed by @nex.
-- Fixed a bug that resulted in the `m.federate` field of `m.room.create` being ignored in v12 rooms, allowing remote 
+- Fixed a bug that resulted in the `m.federate` field of `m.room.create` being ignored in v12 rooms, allowing remote
   servers to participate in local-only rooms. Contributed by @nex, reported by [@mat:emzee.ee](matrix:u/mat:emzee.ee?action=chat).
 
 # Continuwuity 0.5.8 (2026-04-24)

src/api/router/auth.rs

@@ -379,6 +379,9 @@ async fn find_token(services: &Services, token: Option<&str>) -> Result<Token> {
 	let Some(token) = token else {
 		return Ok(Token::None);
 	};
+	if token.is_empty() {
+		return Ok(Token::Invalid);
+	}
 
 	let user_token = services.users.find_from_token(token).map_ok(Token::User);
 

src/service/users/mod.rs

@@ -339,6 +339,7 @@ impl Service {
 
 	/// Find out which user an access token belongs to.
 	pub async fn find_from_token(&self, token: &str) -> Result<(OwnedUserId, OwnedDeviceId)> {
+		assert!(!token.is_empty(), "Empty access token");
 		self.db.token_userdeviceid.get(token).await.deserialized()
 	}