mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-02-14 05:24:24 +01:00
2e42378b16
* 🔒 fix: Secure Cookie Localhost Bypass and OpenID Token Selection in AuthService Two independent bugs in `api/server/services/AuthService.js` cause complete authentication failure when using `OPENID_REUSE_TOKENS=true` with Microsoft Entra ID (or Auth0) on `http://localhost` with `NODE_ENV=production`: Bug 1: `secure: isProduction` prevents auth cookies on localhost PR #11518 introduced `shouldUseSecureCookie()` in `socialLogins.js` to handle the case where `NODE_ENV=production` but the server runs on `http://localhost`. However, `AuthService.js` was not updated — it still used `secure: isProduction` in 6 cookie locations across `setAuthTokens()` and `setOpenIDAuthTokens()`. The `token_provider` cookie being dropped is critical: without it, `requireJwtAuth` middleware defaults to the `jwt` strategy instead of `openidJwt`, causing all authenticated requests to return 401. Bug 2: `setOpenIDAuthTokens()` returns `access_token` instead of `id_token` The `openIdJwtStrategy` validates the Bearer token via JWKS. For Entra ID without `OPENID_AUDIENCE`, the `access_token` is a Microsoft Graph API token (opaque or signed for a different audience), which fails JWKS validation. The `id_token` is always a standard JWT signed by the IdP's JWKS keys with the app's `client_id` as audience — which is what the strategy expects. This is the same root cause as issue #8796 (Auth0 encrypted access tokens). Changes: - Consolidate `shouldUseSecureCookie()` into `packages/api/src/oauth/csrf.ts` as a shared, typed utility exported from `@librechat/api`, replacing the duplicate definitions in `AuthService.js` and `socialLogins.js` - Move `isProduction` check inside the function body so it is evaluated at call time rather than module load time - Fix `packages/api/src/oauth/csrf.ts` which also used bare `secure: isProduction` for CSRF and session cookies (same localhost bug) - Return `tokenset.id_token || tokenset.access_token` from `setOpenIDAuthTokens()` so JWKS validation works with standard OIDC providers; falls back to `access_token` for backward compatibility - Add 15 tests for `shouldUseSecureCookie()` covering production/dev modes, localhost variants, edge cases, and a documented IPv6 bracket limitation - Add 13 tests for `setOpenIDAuthTokens()` covering token selection, session storage, cookie secure flag delegation, and edge cases Refs: #8796, #11518, #11236, #9931 * chore: Adjust Import Order and Type Definitions in AgentPanel Component - Reordered imports in `AgentPanel.tsx` for better organization and clarity. - Updated type imports to ensure proper usage of `FieldNamesMarkedBoolean` and `TranslationKeys`. - Removed redundant imports to streamline the codebase.
109 lines
3.1 KiB
JavaScript
109 lines
3.1 KiB
JavaScript
const passport = require('passport');
|
|
const session = require('express-session');
|
|
const { CacheKeys } = require('librechat-data-provider');
|
|
const { isEnabled, shouldUseSecureCookie } = require('@librechat/api');
|
|
const { logger, DEFAULT_SESSION_EXPIRY } = require('@librechat/data-schemas');
|
|
const {
|
|
openIdJwtLogin,
|
|
facebookLogin,
|
|
discordLogin,
|
|
setupOpenId,
|
|
googleLogin,
|
|
githubLogin,
|
|
appleLogin,
|
|
setupSaml,
|
|
} = require('~/strategies');
|
|
const { getLogStores } = require('~/cache');
|
|
|
|
/**
|
|
* Configures OpenID Connect for the application.
|
|
* @param {Express.Application} app - The Express application instance.
|
|
* @returns {Promise<void>}
|
|
*/
|
|
async function configureOpenId(app) {
|
|
logger.info('Configuring OpenID Connect...');
|
|
const sessionExpiry = Number(process.env.SESSION_EXPIRY) || DEFAULT_SESSION_EXPIRY;
|
|
const sessionOptions = {
|
|
secret: process.env.OPENID_SESSION_SECRET,
|
|
resave: false,
|
|
saveUninitialized: false,
|
|
store: getLogStores(CacheKeys.OPENID_SESSION),
|
|
cookie: {
|
|
maxAge: sessionExpiry,
|
|
secure: shouldUseSecureCookie(),
|
|
},
|
|
};
|
|
app.use(session(sessionOptions));
|
|
app.use(passport.session());
|
|
|
|
const config = await setupOpenId();
|
|
if (!config) {
|
|
logger.error('OpenID Connect configuration failed - strategy not registered.');
|
|
return;
|
|
}
|
|
|
|
if (isEnabled(process.env.OPENID_REUSE_TOKENS)) {
|
|
logger.info('OpenID token reuse is enabled.');
|
|
passport.use('openidJwt', openIdJwtLogin(config));
|
|
}
|
|
logger.info('OpenID Connect configured successfully.');
|
|
}
|
|
|
|
/**
|
|
*
|
|
* @param {Express.Application} app
|
|
*/
|
|
const configureSocialLogins = async (app) => {
|
|
logger.info('Configuring social logins...');
|
|
|
|
if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
|
|
passport.use(googleLogin());
|
|
}
|
|
if (process.env.FACEBOOK_CLIENT_ID && process.env.FACEBOOK_CLIENT_SECRET) {
|
|
passport.use(facebookLogin());
|
|
}
|
|
if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {
|
|
passport.use(githubLogin());
|
|
}
|
|
if (process.env.DISCORD_CLIENT_ID && process.env.DISCORD_CLIENT_SECRET) {
|
|
passport.use(discordLogin());
|
|
}
|
|
if (process.env.APPLE_CLIENT_ID && process.env.APPLE_PRIVATE_KEY_PATH) {
|
|
passport.use(appleLogin());
|
|
}
|
|
if (
|
|
process.env.OPENID_CLIENT_ID &&
|
|
process.env.OPENID_CLIENT_SECRET &&
|
|
process.env.OPENID_ISSUER &&
|
|
process.env.OPENID_SCOPE &&
|
|
process.env.OPENID_SESSION_SECRET
|
|
) {
|
|
await configureOpenId(app);
|
|
}
|
|
if (
|
|
process.env.SAML_ENTRY_POINT &&
|
|
process.env.SAML_ISSUER &&
|
|
process.env.SAML_CERT &&
|
|
process.env.SAML_SESSION_SECRET
|
|
) {
|
|
logger.info('Configuring SAML Connect...');
|
|
const sessionExpiry = Number(process.env.SESSION_EXPIRY) || DEFAULT_SESSION_EXPIRY;
|
|
const sessionOptions = {
|
|
secret: process.env.SAML_SESSION_SECRET,
|
|
resave: false,
|
|
saveUninitialized: false,
|
|
store: getLogStores(CacheKeys.SAML_SESSION),
|
|
cookie: {
|
|
maxAge: sessionExpiry,
|
|
secure: shouldUseSecureCookie(),
|
|
},
|
|
};
|
|
app.use(session(sessionOptions));
|
|
app.use(passport.session());
|
|
setupSaml();
|
|
|
|
logger.info('SAML Connect configured.');
|
|
}
|
|
};
|
|
|
|
module.exports = configureSocialLogins;
|