Skip to content

fix: move OpenAI API key from client-side session cookie to server-side storage (CWE-200) #63

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sebastiondev wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: move OpenAI API key from client-side session cookie to server-side storage (CWE-200) #63

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 25 additions & 18 deletions memoryos-playground/memdemo/app.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,14 +96,17 @@ def init_memory():
)

session_id = secrets.token_hex(8)
memory_systems[session_id] = memory_system
session['memory_session_id'] = session_id
# 将配置存入session
session['memory_config'] = {
'api_key': api_key,
'base_url': base_url,
'model': model
# Store both memory system and config server-side to avoid
# leaking the API key in the client-side session cookie.
memory_systems[session_id] = {
'system': memory_system,
'config': {
'api_key': api_key,
'base_url': base_url,
'model': model,
},
}
session['memory_session_id'] = session_id

return jsonify({
'success': True,
Expand All @@ -125,7 +128,7 @@ def chat():
if not session_id or session_id not in memory_systems:
return jsonify({'error': 'Memory system not initialized'}), 400

memory_system = memory_systems[session_id]
memory_system = memory_systems[session_id]['system']

try:
# Get response from memoryos (this already adds the memory internally)
Expand All @@ -146,7 +149,7 @@ def get_memory_state():
if not session_id or session_id not in memory_systems:
return jsonify({'error': 'Memory system not initialized'}), 400

memory_system = memory_systems[session_id]
memory_system = memory_systems[session_id]['system']

try:
# Get short-term memory
Expand Down Expand Up @@ -200,7 +203,7 @@ def trigger_analysis():
if not session_id or session_id not in memory_systems:
return jsonify({'error': 'Memory system not initialized'}), 400

memory_system = memory_systems[session_id]
memory_system = memory_systems[session_id]['system']

try:
# Check if there are any mid-term memory sessions to analyze
Expand Down Expand Up @@ -230,7 +233,7 @@ def personality_analysis():
if not session_id or session_id not in memory_systems:
return jsonify({'error': 'Memory system not initialized'}), 400

memory_system = memory_systems[session_id]
memory_system = memory_systems[session_id]['system']

try:
# Get user profile
Expand Down Expand Up @@ -336,7 +339,8 @@ def clear_memory():
if not session_id or session_id not in memory_systems:
return jsonify({'error': 'Memory system not initialized'}), 400

memory_system = memory_systems[session_id]
entry = memory_systems[session_id]
memory_system = entry['system']

try:
# Clear all memory files
Expand All @@ -351,10 +355,10 @@ def clear_memory():
if os.path.exists(assistant_data_dir):
shutil.rmtree(assistant_data_dir)

# 从session中获取配置来重新初始化
config = session.get('memory_config')
# Retrieve config from server-side storage (not from session cookie)
config = entry.get('config')
if not config:
return jsonify({'error': 'Configuration not found in session. Please re-initialize.'}), 400
return jsonify({'error': 'Configuration not found. Please re-initialize.'}), 400

api_key = config['api_key']
base_url = config['base_url']
Expand All @@ -378,7 +382,10 @@ def clear_memory():
)

# Replace the old memory system
memory_systems[session_id] = new_memory_system
memory_systems[session_id] = {
'system': new_memory_system,
'config': config,
}

return jsonify({'success': True, 'message': 'All memories cleared successfully'})
except Exception as e:
Expand All @@ -390,7 +397,7 @@ def import_conversations():
if not session_id or session_id not in memory_systems:
return jsonify({'error': 'Memory system not initialized'}), 400

memory_system = memory_systems[session_id]
memory_system = memory_systems[session_id]['system']
data = request.json
conversations = data.get('conversations', [])

Expand Down Expand Up @@ -424,4 +431,4 @@ def import_conversations():
return jsonify({'error': str(e)}), 500

if __name__ == '__main__':
app.run(debug=True, host='0.0.0.0', port=5019)
app.run(debug=True, host='0.0.0.0', port=5019)