tdpeuter/open-webui
tdpeuter/open-webui
1
Fork 0
forked from open-webui/open-webui
Code Issues Pull requests 1 Projects 1 Releases 2 Packages 1 Activity Actions

Even though "User.email" is enforced as unique at signup, it is not a unique field in the database. Let's use "User.id" instead. This also makes it more difficult to do a session stealing attack.

Browse source
This commit is contained in:
Tim Farrell 2024-02-01 14:04:48 -06:00
parent 2c1dacb9b6
commit 8c37edd027
2 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
backend/utils/utils.py
View file

@ -60,8 +60,8 @@ def extract_token_from_auth_header(auth_header: str):
def get_current_user(auth_token: HTTPAuthorizationCredentials = Depends(HTTPBearer())):
data = decode_token(auth_token.credentials)
if data != None and "email" in data:
user = Users.get_user_by_email(data["email"])
if data != None and "id" in data:
user = Users.get_user_by_id(data["id"])
if user is None:
raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED,