LibreChat/api
Danny Avila b8c31e7314
🔱 chore: Harden API Routes Against IDOR and DoS Attacks (#11760)
* 🔧 feat: Update user key handling in keys route and add comprehensive tests

- Enhanced the PUT /api/keys route to destructure request body for better clarity and maintainability.
- Introduced a new test suite for keys route, covering key update, deletion, and retrieval functionalities, ensuring robust validation and IDOR prevention.
- Added tests to verify handling of extraneous fields and missing optional parameters in requests.

* 🔧 fix: Enhance conversation deletion route with parameter validation

- Updated the DELETE /api/convos route to handle cases where the request body is empty or the 'arg' parameter is null/undefined, returning a 400 status with an appropriate error message for DoS prevention.
- Added corresponding tests to ensure proper validation and error handling for these scenarios, enhancing the robustness of the API.

* 🔧 fix: Improve request body validation in keys and convos routes

- Updated the DELETE /api/convos and PUT /api/keys routes to validate the request body, returning a 400 status for null or invalid bodies to enhance security and prevent potential DoS attacks.
- Added corresponding tests to ensure proper error handling for these scenarios, improving the robustness of the API.
2026-02-12 18:08:24 -05:00
..
app 🧩 refactor: Tool Context Builders for Web Search & Image Gen (#11644) 2026-02-05 14:10:19 +01:00
cache 🗃️ refactor: Separate Tool Cache Namespace for Blue/Green Deployments (#11738) 2026-02-11 22:20:43 -05:00
config 🪵 fix: Standardize Logging Directory with Environment-Aware Resolution (#11000) 2025-12-16 18:00:06 -05:00
db 🔎 fix: Include Legacy Documents With Undefined _meiliIndex in Search Sync (#11745) 2026-02-12 18:05:53 -05:00
models 🤖 feat: Claude Opus 4.6 - 1M Context, Premium Pricing, Adaptive Thinking (#11670) 2026-02-06 18:35:36 -05:00
server 🔱 chore: Harden API Routes Against IDOR and DoS Attacks (#11760) 2026-02-12 18:08:24 -05:00
strategies 🏢 fix: Handle Group Overage for Azure Entra Authentication (#11557) 2026-02-11 22:11:05 -05:00
test 💾 feat: Add Memory Configuration Options for CI unit tests (#10567) 2025-12-25 16:17:17 -05:00
utils 🤖 feat: Claude Opus 4.6 - 1M Context, Premium Pricing, Adaptive Thinking (#11670) 2026-02-06 18:35:36 -05:00
jest.config.js 🪦 refactor: Remove Legacy Code (#10533) 2025-12-11 16:36:12 -05:00
jsconfig.json feat(api): initial Redis support; fix(SearchBar): proper debounce (#1039) 2023-10-11 17:05:47 -04:00
package.json 📦 chore: @librechat/agents to v3.1.41 (#11759) 2026-02-12 17:43:43 -05:00
typedefs.js 🪦 refactor: Remove Legacy Code (#10533) 2025-12-11 16:36:12 -05:00