🔒 fix: remove apiKey fallback in webapi auth to prevent auth bypass by arvinxx · Pull Request #13535 · lobehub/lobehub

arvinxx · 2026-04-03T04:22:50Z

Summary

Remove the entire XOR obfuscation auth mechanism — the X-lobe-chat-auth header with hardcoded XOR key (LobeHub · LobeHub) was forgeable, allowing auth bypass and user impersonation
Remove legacy apiKey fallback in checkAuthMethod — only accept verified Better Auth sessions
Rewrite checkAuth middleware to derive userId from server-validated session (Better Auth) or OIDC token, never trusting client-supplied headers
Delete XOR utility files (xor-obfuscation.ts, xor.ts) and their tests
Delete dead keyVaults TRPC middleware (decoded XOR payload but had zero consumers)
Simplify createHeaderWithAuth — no longer encodes/sends XOR payload
Remove SECRET_XOR_KEY constant and authorizationHeader from TRPC lambda context
Clean up CLI to only send Oidc-Auth header

The LOBE_CHAT_AUTH_HEADER constant is retained for the async caller (server-to-server) which uses AES encryption via KeyVaultsGateKeeper — a separate, secure mechanism.

Context

Ref: GHSA-5mwj-v5jw-5c97

Attack vector: forge {"apiKey":"x","userId":"victim-id"} via XOR with the hardcoded key → bypass auth → initModelRuntimeFromDB reads victim's provider API keys from DB.

Files changed (23 files, -1035 lines)

Category	Files
Deleted	`xor-obfuscation.ts`, `xor.ts`, `keyVaults.ts` + tests
Auth middleware	`checkAuth`, `checkAuthMethod`, tests
Client services	`_auth.ts` (140→9 lines)
TRPC	`context.ts`, `chunk.ts`, `ragEval.ts`
CLI	`http.ts`, `generate.test.ts`
Config	`envs/auth.ts` (remove `SECRET_XOR_KEY`)

Test plan

Verify webapi routes reject requests without a valid session
Verify authenticated users with session cookies work normally
Verify OIDC auth path (CLI) remains functional
Verify TRPC lambda routes work without keyVaults middleware
Verify async caller (server-to-server AES path) is unaffected

🤖 Generated with Claude Code

vercel · 2026-04-03T04:22:56Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
lobehub	Ready	Preview, Comment	Apr 7, 2026 3:21am

lobehubbot · 2026-04-03T04:23:46Z

@tjx666 @nekomeowww - This is a security fix for the webapi auth middleware, removing an apiKey bypass and enforcing server-validated session userId. Please review the auth changes and backend impact.

sourcery-ai

We've reviewed this pull request using the Sourcery rules engine

codecov · 2026-04-03T04:27:43Z

Codecov Report

❌ Patch coverage is 95.23810% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.61%. Comparing base (dbdbe16) to head (391b0ae).
⚠️ Report is 17 commits behind head on canary.

❗ There is a different number of reports uploaded between BASE (dbdbe16) and HEAD (391b0ae). Click for more details.

HEAD has 13 uploads less than BASE

Flag BASE (dbdbe16) HEAD (391b0ae)

packages/file-loaders 2 1

packages/prompts 2 1

packages/model-runtime 2 1

packages/web-crawler 2 1

packages/python-interpreter 2 1

packages/context-engine 2 1

packages/utils 2 1

packages/agent-runtime 2 1

packages/conversation-flow 2 1

packages/ssrf-safe-fetch 2 1

packages/model-bank 2 1

database 2 1

packages/memory-user-memory 2 1

Additional details and impacted files

@@             Coverage Diff             @@
##           canary   #13535       +/-   ##
===========================================
- Coverage   86.00%   66.61%   -19.39%     
===========================================
  Files         609     1993     +1384     
  Lines       49045   165546   +116501     
  Branches     7596    19915    +12319     
===========================================
+ Hits        42179   110285    +68106     
- Misses       6742    55137    +48395     
  Partials      124      124

Flag	Coverage Δ
app	`58.48% <95.23%> (?)`
database	`92.57% <ø> (ø)`
packages/agent-runtime	`88.98% <ø> (ø)`
packages/context-engine	`85.39% <ø> (ø)`
packages/conversation-flow	`92.36% <ø> (ø)`
packages/file-loaders	`87.02% <ø> (ø)`
packages/memory-user-memory	`66.68% <ø> (ø)`
packages/model-bank	`99.85% <ø> (ø)`
packages/model-runtime	`84.66% <ø> (ø)`
packages/prompts	`65.80% <ø> (ø)`
packages/python-interpreter	`92.90% <ø> (ø)`
packages/ssrf-safe-fetch	`0.00% <ø> (ø)`
packages/utils	`89.74% <ø> (-0.29%)`	⬇️
packages/web-crawler	`88.82% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
Store	`67.09% <ø> (∅)`
Services	`51.43% <100.00%> (∅)`
Server	`65.99% <ø> (∅)`
Libs	`51.05% <100.00%> (∅)`
Utils	`91.01% <ø> (-2.46%)`	⬇️

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…w-5c97) Completely remove the forgeable X-lobe-chat-auth XOR obfuscation mechanism: - Remove apiKey fallback in checkAuthMethod (auth bypass vector) - Rewrite checkAuth to use session/OIDC userId only, never trust client header - Delete XOR encoding/decoding utilities and tests - Delete dead keyVaults TRPC middleware (no consumers) - Simplify createHeaderWithAuth (no longer sends XOR payload) - Remove SECRET_XOR_KEY constant - Remove authorizationHeader from TRPC lambda context - Clean up CLI to only send Oidc-Auth header - Update all affected tests The LOBE_CHAT_AUTH_HEADER constant is retained for the async caller (server-to-server) path which uses AES encryption via KeyVaultsGateKeeper. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The client-side model runtime (fetchOnClient) needs getProviderAuthPayload and createPayloadWithKeyVaults to build provider SDK init params directly in the browser. These functions are unrelated to XOR encoding. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add explicit null check before accessing session.user.id to prevent TypeError when session is null (e.g. unauthenticated requests). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The createRuntime property was removed from checkAuth's RequestHandler type but still referenced in the route handler, causing TS2339. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

@chriszf

# 🚀 release: 20260407 This release includes **148 commits**. Key updates are below. - **Response API tool execution is more capable and reliable** — Added hosted builtin tools + client-side function tools and improved tool-call streaming/completion behavior. [#13406](#13406) [#13414](#13414) [#13506](#13506) [#13555](#13555) - **Input and composition UX upgraded** — Added AI input auto-completion and multiple chat-input stability fixes. [#13458](#13458) [#13551](#13551) [#13481](#13481) - **Model/provider compatibility improved** — Better Gemini/Google tool schema handling and additional model updates. [#13429](#13429) [#13465](#13465) [#13613](#13613) - **Desktop and CLI reliability improved** — Gateway WebSocket support and desktop runtime upgrades. [#13608](#13608) [#13550](#13550) [#13557](#13557) - **Security hardening continued** — Fixed auth and sanitization risks and upgraded vulnerable dependencies. [#13535](#13535) [#13529](#13529) [#13479](#13479) ### Models & Providers - Added/updated support for `glm-5v-turbo`, GLM-5.1 updates, and qwen3.5-omni series. [#13487](#13487) [#13405](#13405) [#13422](#13422) - Added additional ImageGen providers/models (Wanxiang 2.7 and Keling from Qwen). [#13478](#13478) - Improved Gemini/Google tool schema and compatibility handling across runtime paths. [#13429](#13429) [#13465](#13465) [#13613](#13613) ### Response API & Runtime - Added hosted builtin tools in Response API and client-side function tool execution support. [#13406](#13406) [#13414](#13414) - Improved stream tool-call argument handling and `response.completed` output correctness. [#13506](#13506) [#13555](#13555) - Improved runtime error/context handling for intervention and provider edge cases. [#13420](#13420) [#13607](#13607) ### Desktop App - Bumped desktop dependencies and runtime integrations (`agent-browser`, `electron`). [#13550](#13550) [#13557](#13557) - Simplified desktop release channel setup by removing nightly release flow. [#13480](#13480) ### CLI - Added OpenClaw migration command. [#13566](#13566) - Added local device binding support for `lh agent run`. [#13277](#13277) - Added WebSocket gateway support and reconnect reliability improvements. [#13608](#13608) [#13418](#13418) ### Security - Removed risky `apiKey` fallback behavior in webapi auth path to prevent bypass risk. [#13535](#13535) - Sanitized HTML artifact rendering and iframe sandboxing to reduce XSS-to-RCE risk. [#13529](#13529) - Upgraded nodemailer to v8 to address SMTP command injection advisory. [#13479](#13479) ### Bug Fixes - Fixed image generation model default switch issues. [#13587](#13587) - Fixed subtopic re-fork message scope behavior and agent panel reset edge cases. [#13606](#13606) [#13556](#13556) - Fixed chat-input freeze on paste and mention plugin behavior. [#13551](#13551) [#13415](#13415) - Fixed auth/social sign-in and settings UX edge cases. [#13368](#13368) [#13392](#13392) [#13338](#13338) ### Credits Huge thanks to these contributors: @chriszf @hardy-one @Innei @lijian @neko @OctopusNote @rdmclin2 @rivertwilight @RylanCai @suyua9 @sxjeru @Tsuki @wangyk @WindSpiritSR @yizhuo @YuTengjing @hezhijie0327 @arvinxx

sourcery-ai bot reviewed Apr 3, 2026

View reviewed changes

vercel bot deployed to Preview April 3, 2026 04:33 View deployment

arvinxx force-pushed the fix/webapi-auth-bypass branch from 0a41f15 to 52edb25 Compare April 3, 2026 13:01

vercel bot had a problem deploying to Preview April 3, 2026 13:06 Failure

vercel bot deployed to Preview April 3, 2026 13:18 View deployment

vercel bot deployed to Preview April 3, 2026 13:33 View deployment

vercel bot deployed to Preview April 3, 2026 13:53 View deployment

arvinxx and others added 5 commits April 7, 2026 11:10

🐛 fix: guard against null session before accessing user id

63050db

Add explicit null check before accessing session.user.id to prevent TypeError when session is null (e.g. unauthenticated requests). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

🐛 fix: add missing AgentRuntimeError import

43931e1

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

🐛 fix: remove dead createRuntime code path causing type error

391b0ae

The createRuntime property was removed from checkAuth's RequestHandler type but still referenced in the route handler, causing TS2339. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

arvinxx force-pushed the fix/webapi-auth-bypass branch from da4fd57 to 391b0ae Compare April 7, 2026 03:16

vercel bot deployed to Preview April 7, 2026 03:21 View deployment

arvinxx merged commit 3327b29 into canary Apr 7, 2026
34 checks passed

arvinxx deleted the fix/webapi-auth-bypass branch April 7, 2026 03:53

nekomeowww mentioned this pull request Apr 7, 2026

🚀 release: 20260407 #13626

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🔒 fix: remove apiKey fallback in webapi auth to prevent auth bypass#13535

🔒 fix: remove apiKey fallback in webapi auth to prevent auth bypass#13535
arvinxx merged 5 commits intocanaryfrom
fix/webapi-auth-bypass

arvinxx commented Apr 3, 2026 •

edited

Loading

Uh oh!

vercel bot commented Apr 3, 2026 •

edited

Loading

Uh oh!

lobehubbot commented Apr 3, 2026

Uh oh!

sourcery-ai bot left a comment

Uh oh!

codecov bot commented Apr 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

arvinxx commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Context

Files changed (23 files, -1035 lines)

Test plan

Uh oh!

vercel bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lobehubbot commented Apr 3, 2026

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

arvinxx commented Apr 3, 2026 •

edited

Loading

vercel bot commented Apr 3, 2026 •

edited

Loading

codecov bot commented Apr 3, 2026 •

edited

Loading