From a0b3ff0eac17e41dca746d22de7012559cd27cc5 Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Tue, 19 May 2026 06:30:08 +0000
Subject: [PATCH] fix(userFields): keep per-user values in sessionStorage, not
 localStorage

Per-user fields may contain secrets like bearer tokens. Storing them in
localStorage means they survive browser close and are readable by any
script on the origin. Move values to sessionStorage so they are cleared
on browser close, matching the project policy for browser-side secrets.
Field defs (non-secret metadata) stay in localStorage so admins can keep
editing across sessions.
---
 .../src/components/mcp_tools/userFields.ts             | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/ui/litellm-dashboard/src/components/mcp_tools/userFields.ts b/ui/litellm-dashboard/src/components/mcp_tools/userFields.ts
index 9d6b81bec6c..98d2abfd6f3 100644
--- a/ui/litellm-dashboard/src/components/mcp_tools/userFields.ts
+++ b/ui/litellm-dashboard/src/components/mcp_tools/userFields.ts
@@ -2,8 +2,10 @@
  * PROTOTYPE-ONLY mock storage for the MCP "user fields" feature.
  *
  * Real implementation will store defs server-side (per MCP server) and
- * encrypted per-user values in the DB / vault. This file fakes both using
- * localStorage so we can demo the flow without backend changes.
+ * encrypted per-user values in the DB / vault. This file fakes defs in
+ * localStorage so admins can keep editing them across sessions, and keeps
+ * per-user values (which may contain secrets like bearer tokens) in
+ * sessionStorage so they do not survive browser close.
  *
  * Do NOT model real auth/credential storage after this file.
  */
@@ -48,7 +50,7 @@ export function getUserFieldValues(
 ): Record<string, string> {
   if (typeof window === "undefined") return {};
   return safeParse<Record<string, string>>(
-    window.localStorage.getItem(VALUES_KEY(serverId, userId)),
+    window.sessionStorage.getItem(VALUES_KEY(serverId, userId)),
     {},
   );
 }
@@ -59,7 +61,7 @@ export function setUserFieldValues(
   values: Record<string, string>,
 ): void {
   if (typeof window === "undefined") return;
-  window.localStorage.setItem(
+  window.sessionStorage.setItem(
     VALUES_KEY(serverId, userId),
     JSON.stringify(values),
   );