fix(web): authenticate and bound metered /api routes - #1589
Conversation
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
supermemory-mcp | 3b0fc9c | Aug 23 2026, 09:49 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
supermemory-app | 3b0fc9c | Commit Preview URL Branch Preview URL |
Aug 23 2026, 09:52 PM |
How to use the Graphite Merge QueueAdd the label Main to this PR to add it to the merge queue. You must have a Graphite account in order to use the merge queue. Sign up using this link. An organization admin has enabled the Graphite Merge Queue in this repository. Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue. This stack of pull requests is managed by Graphite. Learn more about stacking. |
MaheshtheDev
changed the title
469cd88 to
b8020c9
Compare
|
Claude finished @MaheshtheDev's task in 1m 30s —— View job Review CompleteOverview: Adds server-side session verification and input bounds to metered API routes that were previously vulnerable to forged cookies. Issues found: None — this looks good to ship. Details: The security hardening is well-implemented:
Previously raised concerns (now resolved):
Score: 10/10 | Branch: |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Overview: Adds server-side session verification and input bounds to metered API routes that were previously vulnerable to forged cookies.
Issues found: None — this looks good to ship.
Details:
The security hardening is well-implemented:
-
verify-session.ts— Correctly verifies sessions against the backend auth endpoint with fail-closed behavior (returnsfalseon any error). Usescache: "no-store"andredirect: "error"appropriately. -
/api/og— Session check added at the entry point. ThereadBoundedTexthelper properly caps response size at 2MB with streaming reads, preventing memory exhaustion from malicious large responses. The existing SSRF protection (isPrivateHost, IPv4/IPv6 checks) remains intact. -
/api/onboarding/extract-content— Session check + URL validation (max 10 URLs, http(s) only, ≤2048 chars per URL) properly bounds the Exa API calls. -
/api/onboarding/research— Session check + name/email length limits (200/320 chars) + 60s timeout on the LLM call prevents unbounded resource consumption. -
Deleted
account-status— Good cleanup of an unused, unauthenticated route.
Score: 10/10
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b8020c91b3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
hasVerifiedSession bypasses verification only for development builds served from a localhost host: dev:local runs on localhost while auth lives on api.supermemory.ai, so the session cookie never reaches the route. Also extracts parseHttpUrl so the parsed URL is a const. Both raised in review on #1589.
Merge activity
|
Cherry-picks #1579 and #1580 from @Sravanjangam (security audit #1578), plus improvements on top. - `/api/og`, `/api/onboarding/extract-content` and `/api/onboarding/research` now verify the session against the auth backend; the middleware only checked that a cookie was present, so a forged cookie reached handlers that spend metered Exa/xAI quota. - Bounds those routes: 2MB cap on fetched HTML, max 10 http(s) URLs per request, name/email length limits and a 60s timeout on the LLM call. - De-duplicates URLs before calling Exa, and collapses whitespace in `name`/`email` so a newline can't forge extra prompt lines. Both adapted from @SEPURI-SAI-KRISHNA's #1528 and #1530. - Deletes the unused, unauthenticated `account-status` route. Verified locally: pre-fix `/api/og` returned 200 for a forged cookie, post-fix it returns 401. Five duplicate URLs collapse to two before reaching Exa, and a newline-laden `name` arrives as a single prompt line. Supersedes #1528 and #1530.
e8f720d to
3b0fc9c
Compare
…og (#1596) Cherry-picks two cleanup PRs and finishes the job. Net 262 deletions. - #1473 (@abhay-codes07): drops a `console.log` in the fullscreen note editor that printed the whole note body on every keystroke, which PostHog session replay can capture. - #1563 (@ishaanxgupta): removes `/api/onboarding/research` and `/api/onboarding/extract-content`. Neither has a caller anywhere in the repo, and both spent metered Exa and xAI quota. This reverts the guards added for them in #1589, which only existed to make unreachable code safe. - On top: `EXA_API_KEY`, `XAI_API_KEY` and the `@ai-sdk/xai` dependency are removed, since deleting those routes left them with no consumer. Co-Authored-By: abhay-codes07 <182421137+abhay-codes07@users.noreply.github.com> Co-Authored-By: ishaanxgupta <124028055+ishaanxgupta@users.noreply.github.com>
2 participants
Cherry-picks #1579 and #1580 from @Sravanjangam (security audit #1578), plus improvements on top.
/api/og,/api/onboarding/extract-contentand/api/onboarding/researchnow verify the session against the auth backend; the middleware only checked that a cookie was present, so a forged cookie reached handlers that spend metered Exa/xAI quota.name/emailso a newline can't forge extra prompt lines. Both adapted from @SEPURI-SAI-KRISHNA's fix(web): bound and validate the onboarding extract-content batch #1528 and fix(web): bound the free-text context fed into the research prompt #1530.account-statusroute.Verified locally: pre-fix
/api/ogreturned 200 for a forged cookie, post-fix it returns 401. Five duplicate URLs collapse to two before reaching Exa, and a newline-ladennamearrives as a single prompt line.Supersedes #1528 and #1530.