Tim Farrell
08e8e922fd
Endpoint role-checking was redundantly applied but FastAPI provides a nice abstraction mechanic...so I applied it. There should be no logical changes in this code; only simpler, cleaner ways for doing the same thing.
2024-02-08 18:05:01 -06:00
Timothy Farrell
b8cc21a9f6
Merge branch 'ollama-webui:main' into session-security
2024-02-02 09:04:21 -06:00
Tim Farrell
8298cefd62
Fix bash condition formatting
2024-02-02 09:02:48 -06:00
Tim Farrell
1031638d82
Maintain backward compatibility with WEBUI_JWT_SECRET_KEY for the time being
2024-02-02 09:02:35 -06:00
Tim Farrell
e2d481d99a
Move the random secret generation to start.sh.
...
This way the random secret is created on first run instead of docker build. We don't really want all standard imaages to share a password anymore than we want a static password.
2024-02-02 09:02:23 -06:00
Tim Farrell
44799e2018
Remove some extraneous imports
2024-02-02 09:02:07 -06:00
Tim Farrell
4fceb404bd
Call jwt.decode with the expected algorithms
2024-02-02 09:01:57 -06:00
Tim Farrell
e15dbdc46a
Pass the instance we're using.
2024-02-02 09:01:34 -06:00
Tim Farrell
8c37edd027
Even though "User.email" is enforced as unique at signup, it is not a unique field in the database. Let's use "User.id" instead. This also makes it more difficult to do a session stealing attack.
2024-02-02 09:01:06 -06:00
Tim Farrell
2c1dacb9b6
We should verify signatures to make the whole session secret meaningful.
2024-02-02 09:00:31 -06:00
Tim Farrell
03a7e35967
Default docker installations should generate a random key instead of using a static secret that everyone can see.
2024-02-02 08:59:46 -06:00
Tim Farrell
d67f3d982b
Start by renaming variables to something more generic. This will give us a bit more flexibility as we look to other session management mechanisms.
2024-02-02 08:58:13 -06:00
Tim Farrell