mirror of
https://github.com/farcasclaudiu/Flowise.git
synced 2026-06-28 13:00:56 +03:00
fix Chatflow API Authentication
This commit is contained in:
@@ -809,18 +809,18 @@ export class App {
|
|||||||
* @param {Response} res
|
* @param {Response} res
|
||||||
* @param {ChatFlow} chatflow
|
* @param {ChatFlow} chatflow
|
||||||
*/
|
*/
|
||||||
async validateKey(req: Request, res: Response, chatflow: ChatFlow) {
|
async validateKey(req: Request, chatflow: ChatFlow) {
|
||||||
const chatFlowApiKeyId = chatflow.apikeyid
|
const chatFlowApiKeyId = chatflow.apikeyid
|
||||||
const authorizationHeader = (req.headers['Authorization'] as string) ?? (req.headers['authorization'] as string) ?? ''
|
const authorizationHeader = (req.headers['Authorization'] as string) ?? (req.headers['authorization'] as string) ?? ''
|
||||||
|
if (chatFlowApiKeyId && !authorizationHeader) return false
|
||||||
if (chatFlowApiKeyId && !authorizationHeader) return res.status(401).send(`Unauthorized`)
|
|
||||||
|
|
||||||
const suppliedKey = authorizationHeader.split(`Bearer `).pop()
|
const suppliedKey = authorizationHeader.split(`Bearer `).pop()
|
||||||
if (chatFlowApiKeyId && suppliedKey) {
|
if (chatFlowApiKeyId && suppliedKey) {
|
||||||
const keys = await getAPIKeys()
|
const keys = await getAPIKeys()
|
||||||
const apiSecret = keys.find((key) => key.id === chatFlowApiKeyId)?.apiSecret
|
const apiSecret = keys.find((key) => key.id === chatFlowApiKeyId)?.apiSecret
|
||||||
if (!compareKeys(apiSecret, suppliedKey)) return res.status(401).send(`Unauthorized`)
|
if (!compareKeys(apiSecret, suppliedKey)) return false
|
||||||
|
return true
|
||||||
}
|
}
|
||||||
|
return false
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@@ -846,7 +846,8 @@ export class App {
|
|||||||
if (!chatId) chatId = chatflowid
|
if (!chatId) chatId = chatflowid
|
||||||
|
|
||||||
if (!isInternal) {
|
if (!isInternal) {
|
||||||
await this.validateKey(req, res, chatflow)
|
const isKeyValidated = await this.validateKey(req, chatflow)
|
||||||
|
if (!isKeyValidated) return res.status(401).send('Unauthorized')
|
||||||
}
|
}
|
||||||
|
|
||||||
let isStreamValid = false
|
let isStreamValid = false
|
||||||
|
|||||||
Reference in New Issue
Block a user