🔏 fix: Remove Federated Tokens from OpenID Refresh Response

[danny-avila]

Summary

Fixed two credential-exposure bugs in the OpenID refreshController response path where server-side-protected tokens and sensitive user fields were being serialized into the JSON response body.

• Removed the explicit user.federatedTokens assignment before res.send({ token, user }) in the OpenID refresh path, which was leaking access_token, id_token, refresh_token, and expires_at into the response body — tokens already stored server-side by setOpenIDAuthTokens (express session + HttpOnly cookies) and re-attached to req.user by the JWT strategy on every authenticated request.
• Destructured out password, __v, totpSecret, and backupCodes from the findOpenIDUser result before serializing, aligning the OpenID path with the non-OpenID path's explicit getUserById projection (-password -__v -totpSecret -backupCodes), which previously left 2FA secrets and password hashes exposed for migrated users.
• Strengthened the regression test: replaced expect.not.objectContaining({ federatedTokens: expect.anything() }) with not.toHaveProperty(...) calls (which correctly catch null/undefined values), added a positive objectContaining shape assertion to prevent false-green passes on empty response objects, populated defaultUser with realistic sensitive field values, and extracted the duplicated mock fixture into a shared defaultUser constant with findOpenIDUser setup moved to beforeEach.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

Verified with the Jest suite in the api workspace (cd api && npx jest AuthController). The updated refreshController – OpenID path describe block covers the fix via the should not expose sensitive fields or federatedTokens in refresh response test, which:

• Seeds findOpenIDUser with a defaultUser containing populated password, totpSecret, backupCodes, and __v fields
• Asserts the sent payload contains the expected safe fields (_id, email, openidId) via objectContaining
• Asserts all five sensitive properties are absent via not.toHaveProperty, catching both omission and explicit null/undefined assignment

Test Configuration:

• OPENID_REUSE_TOKENS=true (simulated via isEnabled.mockReturnValue(true))
• No live IdP required — openid-client, @librechat/api, and all model dependencies are mocked

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes

[Copilot]

Pull request overview

Removes OpenID federated token data (including refresh tokens) from the /refresh endpoint’s JSON response to prevent exposure of HttpOnly-protected credentials to client-side JavaScript.

Changes:

• Stop attaching user.federatedTokens in the OpenID refresh controller response.
• Add a Jest test asserting federatedTokens is not included in the refresh response user payload.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
api/server/controllers/AuthController.js	Removes user.federatedTokens construction before sending the refresh response.
api/server/controllers/AuthController.spec.js	Adds a regression test to ensure refresh responses don’t include federatedTokens.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.