mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-09-08 15:41:38 +00:00
8b5cea29bc
Stamp OpenID session token state with the LibreChat user id, OpenID subject, tenant id, and normalized issuer when tokens are stored. Fail closed before OBO inline token reuse/refresh when the session token identity does not match the current authenticated identity, preventing a stale or mixed Express session from supplying another user's upstream assertion. Also validate the normal /api/auth/refresh session-token reuse shortcut against the signed marker-cookie user before returning cached session tokens. Note: sessions created before this change carry no identity stamp and are treated as a mismatch. This is self-healing — the reuse path forces a full IdP refresh (which re-stamps the session) and the OBO path throws, surfacing as a one-time re-authentication for active OBO users at deploy time. The session re-stamps within one session lifetime (SESSION_EXPIRY, default 15 min). |
||
|---|---|---|
| .. | ||
| LoginController.js | ||
| LogoutController.js | ||
| LogoutController.spec.js | ||
| oauth.js | ||
| oauth.spec.js | ||
| TwoFactorAuthController.js | ||