Mintplex-Labs/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2026-07-19 14:13:35 -04:00
Code Issues 328 Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #4224] [FEAT]: Customize JWT Expiry via config #2684

New Issue
Closed
opened 2026-02-22 18:30:46 -05:00 by yindo · 2 comments
yindo commented 2026-02-22 18:30:46 -05:00
Owner
Copy Link
Copy Source

Originally created by @sha-roze on GitHub (Jul 31, 2025).
Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/4224

Originally assigned to: @timothycarambat on GitHub.

How are you running AnythingLLM?

Docker (local)

What happened?

After logging out, the token remains valid and can still be used to access the server api's.

Are there known steps to reproduce?

  1. Login to any user account. Get the JWT Token from the Authorization header.
  2. Call any API using curl or postman by passing this token in the Authorization header.
Originally created by @sha-roze on GitHub (Jul 31, 2025). Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/4224 Originally assigned to: @timothycarambat on GitHub. ### How are you running AnythingLLM? Docker (local) ### What happened? After logging out, the token remains valid and can still be used to access the server api's. ### Are there known steps to reproduce? 1. Login to any user account. Get the JWT Token from the Authorization header. 2. Call any API using curl or postman by passing this token in the Authorization header.
yindo added the enhancementfeature request labels 2026-02-22 18:30:46 -05:00
yindo closed this issue 2026-02-22 18:30:46 -05:00
yindo commented 2026-02-22 18:30:47 -05:00
Author
Owner
Copy Link
Copy Source

@timothycarambat commented on GitHub (Jul 31, 2025):

We use JWT for authentication - this is not a bug and is an inherent ability of how JWTs work.

JSON Web Tokens (JWTs) are inherently stateless and, by design, are not automatically invalidated upon user logout. Once a JWT access token is issued, it remains cryptographically valid until its embedded expiration time (the exp claim) is reached, regardless of whether the user has logged out or not.

The most we can do is have the JWT function take in a user-defined ENV config that can be set by system admin for shorter lived tokens.

@timothycarambat commented on GitHub (Jul 31, 2025): We use JWT for authentication - this is not a bug and is an inherent ability of how JWTs work. > JSON Web Tokens (JWTs) are inherently stateless and, by design, are not automatically invalidated upon user logout. Once a JWT access token is issued, it remains cryptographically valid until its embedded expiration time (the exp claim) is reached, regardless of whether the user has logged out or not. The most we can do is have the JWT function take in a user-defined ENV config that can be set by system admin for shorter lived tokens.
yindo commented 2026-02-22 18:30:47 -05:00
Author
Owner
Copy Link
Copy Source

@sha-roze commented on GitHub (Aug 1, 2025):

Thanks for taking this up Tim

@sha-roze commented on GitHub (Aug 1, 2025): Thanks for taking this up Tim
yindo changed title from [FEAT]: Customize JWT Expiry via config to [GH-ISSUE #4224] [FEAT]: Customize JWT Expiry via config 2026-06-05 14:47:58 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Desktop
Docker
Integration Request
Integration Request
OS: Linux
OS: Mobile
OS: Windows
UI/UX
blocked
bug
bug
core-team-only
documentation
duplicate
embed-widget
enhancement
feature request
github_actions
good first issue
investigating
needs info / can't replicate
possible bug
pull-request
Mirrored from GitHub Pull Request
 question
stage: specifications
wontfix
No Label enhancement feature request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Mintplex-Labs/anything-llm#2684
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?