langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 12:05:30 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[PR #21030] [Bug] fix misusing ACCESS_TOKEN_EXPIRE_MINUTES in jwt on exp #29549

New Issue
Closed
opened 2026-02-21 20:45:47 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 20:45:47 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/langgenius/dify/pull/21030

State: closed
Merged: Yes

Summary

This commit fixes a bug in the JWT expiration time calculation. Previously, the ACCESS_TOKEN_EXPIRE_MINUTES configuration was being incorrectly interpreted as hours instead of minutes. The issue has been resolved by updating the calculation in the passport.py file to correctly use timedelta(minutes=dify_config.ACCESS_TOKEN_EXPIRE_MINUTES).

Changes:

  • The incorrect line: 
    exp_dt = datetime.now(UTC) + timedelta(hours=dify_config.ACCESS_TOKEN_EXPIRE_MINUTES * 24)
    was updated to: 
    exp_dt = datetime.now(UTC) + timedelta(minutes=dify_config.ACCESS_TOKEN_EXPIRE_MINUTES)
  • This ensures that the expiration time now correctly reflects the intended configuration in minutes.

Motivation:

This change was necessary to ensure correct handling of token expiration times, avoiding unintended long expiration periods that could compromise security.

Screenshots

Before After
JWT expiration was calculated using hours, leading to incorrect expiration times. JWT expiration is now calculated using minutes, as intended by the configuration.

Checklist

  • This change requires a documentation update, included: Dify Document
  • I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • I've updated the documentation accordingly.
  • I ran dev/reformat (backend) and cd web && npx lint-staged (frontend) to appease the lint gods.
**Original Pull Request:** https://github.com/langgenius/dify/pull/21030 **State:** closed **Merged:** Yes --- ## Summary This commit fixes a bug in the JWT expiration time calculation. Previously, the `ACCESS_TOKEN_EXPIRE_MINUTES` configuration was being incorrectly interpreted as hours instead of minutes. The issue has been resolved by updating the calculation in the `passport.py` file to correctly use `timedelta(minutes=dify_config.ACCESS_TOKEN_EXPIRE_MINUTES)`. ### Changes: - The incorrect line: ```python exp_dt = datetime.now(UTC) + timedelta(hours=dify_config.ACCESS_TOKEN_EXPIRE_MINUTES * 24) ``` was updated to: ```python exp_dt = datetime.now(UTC) + timedelta(minutes=dify_config.ACCESS_TOKEN_EXPIRE_MINUTES) ``` - This ensures that the expiration time now correctly reflects the intended configuration in minutes. ### Motivation: This change was necessary to ensure correct handling of token expiration times, avoiding unintended long expiration periods that could compromise security. ## Screenshots | Before | After | |--------|-------| | JWT expiration was calculated using hours, leading to incorrect expiration times. | JWT expiration is now calculated using minutes, as intended by the configuration. | ## Checklist - [ ] This change requires a documentation update, included: [Dify Document](https://github.com/langgenius/dify-docs) - [x] I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!) - [x] I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change. - [x] I've updated the documentation accordingly. - [x] I ran `dev/reformat` (backend) and `cd web && npx lint-staged` (frontend) to appease the lint gods.
yindo added the pull-request label 2026-02-21 20:45:47 -05:00
yindo closed this issue 2026-02-21 20:45:47 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#29549
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?