tdpeuter/open-webui
tdpeuter/open-webui
1
Fork 0
forked from open-webui/open-webui
Code Issues Pull requests 1 Releases 2 Packages Activity Actions

Even though "User.email" is enforced as unique at signup, it is not a unique field in the database. Let's use "User.id" instead. This also makes it more difficult to do a session stealing attack.

Browse source
This commit is contained in:
Tim Farrell 2024-02-01 14:04:48 -06:00
parent 2c1dacb9b6
commit 8c37edd027
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
backend/apps/web/routers/auths.py
View file

@ -93,7 +93,7 @@ async def update_password(
async def signin(form_data: SigninForm):
user = Auths.authenticate_user(form_data.email.lower(), form_data.password)
if user:
token = create_token(data={"email": user.email})
token = create_token(data={"id": user.id})
return {
"token": token,
@ -132,7 +132,7 @@ async def signup(request: Request, form_data: SignupForm):
)
if user:
token = create_token(data={"email": user.email})
token = create_token(data={"id": user.id})
# response.set_cookie(key='token', value=token, httponly=True)
return {

4
backend/utils/utils.py
View file

@ -60,8 +60,8 @@ def extract_token_from_auth_header(auth_header: str):
def get_current_user(auth_token: HTTPAuthorizationCredentials = Depends(HTTPBearer())):
data = decode_token(auth_token.credentials)
if data != None and "email" in data:
user = Users.get_user_by_email(data["email"])
if data != None and "id" in data:
user = Users.get_user_by_id(data["id"])
if user is None:
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,