This PR changes a few things around how sessions are handled in order to improve security.
Problem 1: The session secret is hard-coded. Few people will provide their own thus the security of the whole project is a risk for everyone who deploys it.
Solution: One first run, the start script generates a randomly generated session key and stores it to a file. If no secret key is provided, the start script will grab this one. WEBUI_JWT_SECRET_KEY is still accepted. I flagged the line in config.py to be deprecated in the next major release.
Problem 2: JWT signatures were not verified. This makes session stealing easy.
Solution: Remove the option turning off jwt signature verification.
Problem 3: JWTs use email address as the primary method to identify a user. This makes step 2 involve no guesswork at all. If you know someone has session, you can just build the correctly formed JWT and BE them.
Solution: Use database user ids in the JWT instead.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/613
**Author:** [@explorigin](https://github.com/explorigin)
**Created:** 2/1/2024
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `session-security`
---
### 📝 Commits (10+)
- [`98f4f5a`](https://github.com/open-webui/open-webui/commit/98f4f5a0dd5c8068b46b49248b9c3084b66a9588) Merge pull request #411 from ollama-webui/latex-render-fix
- [`1f930fa`](https://github.com/open-webui/open-webui/commit/1f930fa15dabee1cfe2bfb6bcc6564c8e271f50a) feat: rag api endpoint
- [`0d260fa`](https://github.com/open-webui/open-webui/commit/0d260fa0238bc52d624a3a4de4346f18128d61f9) feat: chromadb vector store api
- [`9dd270c`](https://github.com/open-webui/open-webui/commit/9dd270ce7f291497a7b7f8361ba49fd9ecc0a2e4) feat: pdf data load
- [`f69dbf9`](https://github.com/open-webui/open-webui/commit/f69dbf9c242202a55e0bd5491129e42bff4314b1) feat: rag apis added to frontend
- [`b280a03`](https://github.com/open-webui/open-webui/commit/b280a03c9b91a8e9bc9fd938ee24f425761dd690) feat: frontend file upload support
- [`caf6999`](https://github.com/open-webui/open-webui/commit/caf6999fdd811a31e38453498b39169d205981b6) doc: features update
- [`20a6f81`](https://github.com/open-webui/open-webui/commit/20a6f81e3bf0b880c33dfa7cabc101cdeff39349) feat: full integration
- [`2a7cfee`](https://github.com/open-webui/open-webui/commit/2a7cfee15130ad86c8a1a8e7ea4c12f76895b0be) doc: feature wording update
- [`9abb1cf`](https://github.com/open-webui/open-webui/commit/9abb1cffd21890b8a5f5b261f659198d0738453b) fix: file message styling
### 📊 Changes
**1 file changed** (+1 additions, -1 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/start.sh` (+1 -1)
</details>
### 📄 Description
This PR changes a few things around how sessions are handled in order to improve security.
Problem 1: The session secret is hard-coded. Few people will provide their own thus the security of the whole project is a risk for everyone who deploys it.
Solution: One first run, the start script generates a randomly generated session key and stores it to a file. If no secret key is provided, the start script will grab this one. **WEBUI_JWT_SECRET_KEY** is still accepted. I flagged the line in config.py to be deprecated in the next major release.
Problem 2: JWT signatures were not verified. This makes session stealing easy.
Solution: Remove the option turning off jwt signature verification.
Problem 3: JWTs use email address as the primary method to identify a user. This makes step 2 involve no guesswork at all. If you know someone has session, you can just build the correctly formed JWT and BE them.
Solution: Use database user ids in the JWT instead.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/613
Author: @explorigin
Created: 2/1/2024
Status: ❌ Closed
Base:
main← Head:session-security📝 Commits (10+)
98f4f5aMerge pull request #411 from ollama-webui/latex-render-fix1f930fafeat: rag api endpoint0d260fafeat: chromadb vector store api9dd270cfeat: pdf data loadf69dbf9feat: rag apis added to frontendb280a03feat: frontend file upload supportcaf6999doc: features update20a6f81feat: full integration2a7cfeedoc: feature wording update9abb1cffix: file message styling📊 Changes
1 file changed (+1 additions, -1 deletions)
View changed files
📝
backend/start.sh(+1 -1)📄 Description
This PR changes a few things around how sessions are handled in order to improve security.
Problem 1: The session secret is hard-coded. Few people will provide their own thus the security of the whole project is a risk for everyone who deploys it.
Solution: One first run, the start script generates a randomly generated session key and stores it to a file. If no secret key is provided, the start script will grab this one. WEBUI_JWT_SECRET_KEY is still accepted. I flagged the line in config.py to be deprecated in the next major release.
Problem 2: JWT signatures were not verified. This makes session stealing easy.
Solution: Remove the option turning off jwt signature verification.
Problem 3: JWTs use email address as the primary method to identify a user. This makes step 2 involve no guesswork at all. If you know someone has session, you can just build the correctly formed JWT and BE them.
Solution: Use database user ids in the JWT instead.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.