mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-02-13 21:14:24 +01:00
599f4a11f1
* 🔧 fix: Update OAuth error message for clarity - Changed the default error message in the OAuth error route from 'Unknown error' to 'Unknown OAuth error' to provide clearer context during authentication failures. * 🔒 feat: Enhance OAuth flow with CSRF protection and session management - Implemented CSRF protection for OAuth flows by introducing `generateOAuthCsrfToken`, `setOAuthCsrfCookie`, and `validateOAuthCsrf` functions. - Added session management for OAuth with `setOAuthSession` and `validateOAuthSession` middleware. - Updated routes to bind CSRF tokens for MCP and action OAuth flows, ensuring secure authentication. - Enhanced tests to validate CSRF handling and session management in OAuth processes. * 🔧 refactor: Invalidate cached tools after user plugin disconnection - Added a call to `invalidateCachedTools` in the `updateUserPluginsController` to ensure that cached tools are refreshed when a user disconnects from an MCP server after a plugin authentication update. This change improves the accuracy of tool data for users. * chore: imports order * fix: domain separator regex usage in ToolService - Moved the declaration of `domainSeparatorRegex` to avoid redundancy in the `loadActionToolsForExecution` function, improving code clarity and performance. * chore: OAuth flow error handling and CSRF token generation - Enhanced the OAuth callback route to validate the flow ID format, ensuring proper error handling for invalid states. - Updated the CSRF token generation function to require a JWT secret, throwing an error if not provided, which improves security and clarity in token generation. - Adjusted tests to reflect changes in flow ID handling and ensure robust validation across various scenarios.
20 lines
771 B
JavaScript
20 lines
771 B
JavaScript
const cookies = require('cookie');
|
|
const passport = require('passport');
|
|
const { isEnabled } = require('@librechat/api');
|
|
|
|
/**
|
|
* Custom Middleware to handle JWT authentication, with support for OpenID token reuse
|
|
* Switches between JWT and OpenID authentication based on cookies and environment settings
|
|
*/
|
|
const requireJwtAuth = (req, res, next) => {
|
|
const cookieHeader = req.headers.cookie;
|
|
const tokenProvider = cookieHeader ? cookies.parse(cookieHeader).token_provider : null;
|
|
|
|
if (tokenProvider === 'openid' && isEnabled(process.env.OPENID_REUSE_TOKENS)) {
|
|
return passport.authenticate('openidJwt', { session: false })(req, res, next);
|
|
}
|
|
|
|
return passport.authenticate('jwt', { session: false })(req, res, next);
|
|
};
|
|
|
|
module.exports = requireJwtAuth;
|