Mintplex-Labs/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2026-07-19 22:23:50 -04:00
Code Issues 328 Packages Projects Releases 10 Wiki Activity

[PR #2111] [MERGED] Encryption in JWT for single-user password mode #3890

New Issue
Closed
opened 2026-02-22 18:34:42 -05:00 by yindo · 0 comments
yindo commented 2026-02-22 18:34:42 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/Mintplex-Labs/anything-llm/pull/2111
Author: @timothycarambat
Created: 8/13/2024
Status: ✅ Merged
Merged: 8/13/2024
Merged by: @timothycarambat

Base: master ← Head: encrypt-jwt-value

📝 Commits (4)

  • 87526bf wip encrypting jwt value
  • b30b4f6 Encrypt/Decrypt pass in JWT value for verification in single-user password mode
  • b988fc1 Merge branch 'master' into encrypt-jwt-value
  • d92fb78 Merge branch 'master' into encrypt-jwt-value

📊 Changes

3 files changed (+20 additions, -4 deletions)

View changed files

📝 .github/workflows/dev-build.yaml (+1 -1)
📝 server/endpoints/system.js (+5 -1)
📝 server/utils/middleware/validatedRequest.js (+14 -2)

📄 Description

Pull Request Type

  • ✨ feat
  • 🐛 fix
  • ♻️ refactor
  • 💄 style
  • 🔨 chore
  • 📝 docs

Relevant Issues

resolves #xxx

What is in this change?

As a convenience, we have always just included the plaintext password in the JWT so we can quickly compare with requests on the backend. While this does work and is mostly safe, if for whatever reason, the JWT was taken from the user's browser, then it could be used to directly login to the instance without needing to do a JWT replay.

This is very unlikely and only applies to single-user instances that are using simple password protection.

Now, we encrypt and decrypt this p value in the JWT, as a consequence any currently logged-in sessions under these conditions will be logged out as their previous token will not pass validation. All that needs to be done is for the user to log back in to get a compliant token.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/Mintplex-Labs/anything-llm/pull/2111 **Author:** [@timothycarambat](https://github.com/timothycarambat) **Created:** 8/13/2024 **Status:** ✅ Merged **Merged:** 8/13/2024 **Merged by:** [@timothycarambat](https://github.com/timothycarambat) **Base:** `master` ← **Head:** `encrypt-jwt-value` --- ### 📝 Commits (4) - [`87526bf`](https://github.com/Mintplex-Labs/anything-llm/commit/87526bf29da0442058f75024f495ee2332d7c2b5) wip encrypting jwt value - [`b30b4f6`](https://github.com/Mintplex-Labs/anything-llm/commit/b30b4f652bf0d8a2bfe2eb31ab17cdd0964cefd2) Encrypt/Decrypt pass in JWT value for verification in single-user password mode - [`b988fc1`](https://github.com/Mintplex-Labs/anything-llm/commit/b988fc1dd2acadb0e4f8159e848877fa44c4984a) Merge branch 'master' into encrypt-jwt-value - [`d92fb78`](https://github.com/Mintplex-Labs/anything-llm/commit/d92fb7857c648ab7851a7461609c2f2cb0af9d6a) Merge branch 'master' into encrypt-jwt-value ### 📊 Changes **3 files changed** (+20 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/dev-build.yaml` (+1 -1) 📝 `server/endpoints/system.js` (+5 -1) 📝 `server/utils/middleware/validatedRequest.js` (+14 -2) </details> ### 📄 Description ### Pull Request Type <!-- For change type, change [ ] to [x]. --> - [ ] ✨ feat - [ ] 🐛 fix - [x] ♻️ refactor - [ ] 💄 style - [ ] 🔨 chore - [ ] 📝 docs ### Relevant Issues <!-- Use "resolves #xxx" to auto resolve on merge. Otherwise, please use "connect #xxx" --> resolves #xxx ### What is in this change? As a convenience, we have always just included the plaintext password in the JWT so we can quickly compare with requests on the backend. While this does work and is mostly safe, if for whatever reason, the JWT was taken from the user's browser, then it could be used to directly login to the instance without needing to do a JWT replay. This is very unlikely and only applies to single-user instances that are using simple password protection. Now, we encrypt and decrypt this `p` value in the JWT, as a consequence any currently logged-in sessions under these conditions will be logged out as their previous token will not pass validation. All that needs to be done is for the user to log back in to get a compliant token. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-22 18:34:42 -05:00
yindo closed this issue 2026-02-22 18:34:42 -05:00
yindo changed title from [PR #2111] Encryption in JWT for single-user password mode to [PR #2111] [MERGED] Encryption in JWT for single-user password mode 2026-06-05 15:15:44 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Desktop
Docker
Integration Request
Integration Request
OS: Linux
OS: Mobile
OS: Windows
UI/UX
blocked
bug
bug
core-team-only
documentation
duplicate
embed-widget
enhancement
feature request
github_actions
good first issue
investigating
needs info / can't replicate
possible bug
pull-request
Mirrored from GitHub Pull Request
 question
stage: specifications
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Mintplex-Labs/anything-llm#3890
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?