From f8130fdff99cbf526b203c2dd2267e8f10fdaffc Mon Sep 17 00:00:00 2001 From: Henry Date: Mon, 23 Oct 2023 15:46:27 +0100 Subject: [PATCH] fix Chatflow API Authentication --- packages/server/src/index.ts | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/packages/server/src/index.ts b/packages/server/src/index.ts index 9d3f7052..8d4592b5 100644 --- a/packages/server/src/index.ts +++ b/packages/server/src/index.ts @@ -809,18 +809,18 @@ export class App { * @param {Response} res * @param {ChatFlow} chatflow */ - async validateKey(req: Request, res: Response, chatflow: ChatFlow) { + async validateKey(req: Request, chatflow: ChatFlow) { const chatFlowApiKeyId = chatflow.apikeyid const authorizationHeader = (req.headers['Authorization'] as string) ?? (req.headers['authorization'] as string) ?? '' - - if (chatFlowApiKeyId && !authorizationHeader) return res.status(401).send(`Unauthorized`) - + if (chatFlowApiKeyId && !authorizationHeader) return false const suppliedKey = authorizationHeader.split(`Bearer `).pop() if (chatFlowApiKeyId && suppliedKey) { const keys = await getAPIKeys() const apiSecret = keys.find((key) => key.id === chatFlowApiKeyId)?.apiSecret - if (!compareKeys(apiSecret, suppliedKey)) return res.status(401).send(`Unauthorized`) + if (!compareKeys(apiSecret, suppliedKey)) return false + return true } + return false } /** @@ -846,7 +846,8 @@ export class App { if (!chatId) chatId = chatflowid if (!isInternal) { - await this.validateKey(req, res, chatflow) + const isKeyValidated = await this.validateKey(req, chatflow) + if (!isKeyValidated) return res.status(401).send('Unauthorized') } let isStreamValid = false