My API Key was stolen!!! #1123

👀 @HotelEnglish

Thank you for raising an issue. We will investigate into the matter and get back to you as soon as possible. Please make sure you have given us as much context as possible.
非常感谢您提交 issue。我们会尽快调查此事，并尽快回复您。 请确保您已经提供了尽可能多的背景信息。

你加了密码了么？

Bot detected the issue body's language is not English, translate it automatically. 👯👭🏻🧑‍🤝‍🧑👫🧑🏿‍🤝‍🧑🏻👩🏾‍🤝‍👨🏿👬🏿

Have you added a password?

这个问题首先得说清楚：

• 是自己部署的吗？
• • 如果是，如何部署的？
• • 如果不是，使用的官方 demo 站点吗？

Bot detected the issue body's language is not English, translate it automatically. 👯👭🏻🧑‍🤝‍🧑👫🧑🏿‍🤝‍🧑🏻👩🏾‍🤝‍👨🏿👬🏿

This question needs to be clarified first:

• Did you deploy it yourself?
• • If yes, how is it deployed?
• • If not, are you using the official demo site?

你加了密码了么？

楼主还使用了大小写加标点

Bot detected the issue body's language is not English, translate it automatically. 👯👭🏻🧑‍🤝‍🧑👫🧑🏿‍🤝‍🧑🏻👩🏾‍🤝‍👨🏿👬🏿

Have you added a password?

The author also used uppercase and lowercase punctuation

楼主还使用了大小写加标点

如果真是这样，那么可能就是密码被爆破了。类似的问题兄弟产品 ChatNextWeb 也遇到过：

• https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/issues/3275
• https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/issues/518

在 LobeChat 中，目前有关密码校验的实现如下：

export const checkAuth = ({ apiKey, accessCode }: AuthConfig) => {
  const { ACCESS_CODES } = getServerConfig();

  // 如果用户在网页填写 api key，不做密码比对
  if (apiKey) {
    return { auth: true };
  }

  // 如果服务端没有填写 ACCESS_CODES 环境变量
  if (!ACCESS_CODES.length) return { auth: true };

  // 实际比对密码
  if (!accessCode || !ACCESS_CODES.includes(accessCode)) {
    return { auth: false, error: ChatErrorType.InvalidAccessCode };
  }

  return { auth: true };
};

其中关于密码的比对是通过 ACCESS_CODES.includes(accessCode) 这样的纯明文比对来实现的，因此存在被暴力破解的可能性。

我强化一下这块的安全实现吧。

Bot detected the issue body's language is not English, translate it automatically. 👯👭🏻🧑‍🤝‍🧑👫🧑🏿‍🤝‍🧑🏻👩🏾‍🤝‍👨🏿👬🏿

The original poster also used uppercase and lowercase punctuation

If this is the case, then the password may have been compromised. Similar problems have also been encountered by brother product ChatNextWeb:

• https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/issues/3275
• https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/issues/518

In LobeChat, the current implementation of password verification is as follows:

export const checkAuth = ({ apiKey, accessCode }: AuthConfig) => {
  const { ACCESS_CODES } = getServerConfig();

  // If the user fills in the api key on the web page, no password comparison will be performed
  if (apiKey) {
    return { auth: true };
  }

  // If the server does not fill in the ACCESS_CODES environment variable
  if (!ACCESS_CODES.length) return { auth: true };

  // Actual comparison password
  if (!accessCode || !ACCESS_CODES.includes(accessCode)) {
    return { auth: false, error: ChatErrorType.InvalidAccessCode };
  }

  return { auth: true };
};

The comparison of passwords is achieved through pure plaintext comparison such as ACCESS_CODES.includes(accessCode), so there is the possibility of brute force cracking.

Let me strengthen the security implementation of this area.

✅ @HotelEnglish

This issue is closed, If you have any questions, you can comment and reply.
此问题已经关闭。如果您有任何问题，可以留言并回复。

:tada: This issue has been resolved in version 0.123.0 :tada:

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot :package::rocket: