CERBERUS/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2026-09-21 07:36:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

🎟️ refactor: Require Credentials for Local Image Access by Default (#15252)

Browse source 
* 🔐 fix: Protect Local Image Access by Default

* 🔐 fix: Scope Image Authorization to Active Sessions

* 🧹 style: Format Image Authorization Checks

* 🛡️ fix: Harden Image Avatar Authorization

* 🧭 style: Sort Image Authorization Imports

* 🔐 fix: Close Image Authorization Review Gaps

* 🧭 fix: Normalize Stored Avatar Base Paths

* 🏢 fix: Resolve Tenant Assistant Image Policy

* 🛂 fix: Enforce Effective Image Access Policy

* 🧹 style: Flatten Assistant Config Selection

* 🧷 fix: Preserve Image Access Compatibility

* 🪪 fix: Make Image Sessions Revocable

* 🏗️ fix: Move Image Session Policy Into API
This commit is contained in:
Danny Avila 2026-08-27 09:55:27 -04:00 • committed by GitHub
parent ff1784568b
commit de59da9636
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
33 changed files with 1834 additions and 189 deletions
Download patch file Download diff file Expand all files Collapse all files

13
api/server/utils/__tests__/staticCache.spec.js
View file

@ -132,6 +132,19 @@ describe('staticCache', () => {
expect(response.headers['cache-control']).toBe('no-store, no-cache, must-revalidate');
});
it('should prevent shared caching when authorization marks an image private', async () => {
app.use((_req, res, next) => {
res.locals.privateImageCache = true;
next();
});
app.use(staticCache(testDir));
const response = await request(app).get('/test.js').expect(200);
expect(response.headers['cache-control']).toBe('private, no-store');
expect(response.headers.vary).toBe('Cookie');
});
});
describe('cache headers in non-production', () => {

5
api/server/utils/staticCache.js
View file

@ -22,6 +22,11 @@ function staticCache(staticPath, options = {}) {
const enableBrotli = isEnabled(process.env.ENABLE_STATIC_ASSET_BROTLI);
const setHeaders = (res, filePath) => {
if (res.locals?.privateImageCache) {
res.setHeader('Cache-Control', 'private, no-store');
res.setHeader('Vary', 'Cookie');
return;
}
if (process.env.NODE_ENV?.toLowerCase() !== 'production') {
return;
}