scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-26 01:12:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 98

fix(userFields): keep per-user values in sessionStorage, not localStorage

Browse source 
Per-user fields may contain secrets like bearer tokens. Storing them in
localStorage means they survive browser close and are readable by any
script on the origin. Move values to sessionStorage so they are cleared
on browser close, matching the project policy for browser-side secrets.
Field defs (non-secret metadata) stay in localStorage so admins can keep
editing across sessions.
This commit is contained in:
mateo-berri 2026-05-19 06:30:08 +00:00
parent 44d887d598
commit a0b3ff0eac
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
ui/litellm-dashboard/src/components/mcp_tools/userFields.ts
View file

@ -2,8 +2,10 @@
* PROTOTYPE-ONLY mock storage for the MCP "user fields" feature.
*
* Real implementation will store defs server-side (per MCP server) and
* encrypted per-user values in the DB / vault. This file fakes both using
* localStorage so we can demo the flow without backend changes.
* encrypted per-user values in the DB / vault. This file fakes defs in
* localStorage so admins can keep editing them across sessions, and keeps
* per-user values (which may contain secrets like bearer tokens) in
* sessionStorage so they do not survive browser close.
*
* Do NOT model real auth/credential storage after this file.
*/
@ -48,7 +50,7 @@ export function getUserFieldValues(
): Record<string, string> {
if (typeof window === "undefined") return {};
return safeParse<Record<string, string>>(
window.localStorage.getItem(VALUES_KEY(serverId, userId)),
window.sessionStorage.getItem(VALUES_KEY(serverId, userId)),
{},
);
}
@ -59,7 +61,7 @@ export function setUserFieldValues(
values: Record<string, string>,
): void {
if (typeof window === "undefined") return;
window.localStorage.setItem(
window.sessionStorage.setItem(
VALUES_KEY(serverId, userId),
JSON.stringify(values),
);