Andreas/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2025-09-22 08:12:00 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

🔒 fix: update refresh token handling to use plain token instead of hashed token (#5088)

Browse source 
* 🔒 fix: update refresh token handling to use plain token instead of hashed token

* 🔒 fix: simplify logoutUser by using plain refresh token for session lookup
This commit is contained in:
Marco Beretta 2024-12-23 18:38:16 +01:00 • committed by GitHub
parent 04923dd185
commit d6f1ecf75c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 4 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

7
api/server/controllers/AuthController.js
View file

@ -7,7 +7,6 @@ const {
requestPasswordReset,
} = require('~/server/services/AuthService');
const { findSession, getUserById, deleteAllUserSessions } = require('~/models');
const { hashToken } = require('~/server/utils/crypto');
const { logger } = require('~/config');
const registrationController = async (req, res) => {
@ -74,11 +73,9 @@ const refreshController = async (req, res) => {
return res.status(200).send({ token, user });
}
// Hash the refresh token
const hashedToken = await hashToken(refreshToken);
// Find the session with the hashed refresh token
const session = await findSession({ userId: userId, refreshToken: hashedToken });
const session = await findSession({ userId: userId, refreshToken: refreshToken });
if (session && session.expiration > new Date()) {
const token = await setAuthTokens(userId, res, session._id);
res.status(200).send({ token, user });