docs: langflow 1.5 auto-login security doc #9057
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughA new section has been added to the SECURITY.md file, detailing a known authentication bypass vulnerability affecting Langflow versions prior to 1.5.0. The update describes the issue, its impact, and remediation steps, and references relevant documentation for further information. Changes
Possibly related PRs
Suggested labels
Suggested reviewers
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
dosubot
bot
added
the
size:XS
github-actions
bot
added
documentation
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
SECURITY.md(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/docs_development.mdc:0-0
Timestamp: 2025-06-23T12:46:29.953Z
Learning: When writing documentation for Langflow using Docusaurus, always use professional but approachable tone, second person voice for instructions, and present tense for current features.
Learnt from: CR
PR: langflow-ai/langflow#0
File: .cursor/rules/docs_development.mdc:0-0
Timestamp: 2025-06-30T14:40:02.682Z
Learning: Applies to docs/docs/**/*.{md,mdx} : Use consistent terminology: always capitalize 'Langflow', 'Component', and 'Flow' when referring to Langflow concepts; always uppercase 'API' and 'JSON'.
SECURITY.md
Outdated
Comment on lines
55
to
60
| In Langflow versions earlier than 1.5.0, if `LANGFLOW_AUTO_LOGIN` is set to `true`, Langflow automatically logs users in as a superuser without requiring authentication. | ||
| In this case, API requests don't require a Langflow API key. | ||
|
|
||
| To address, upgrade to >= 1.5.0. | ||
|
|
||
| For more information, see [Authentication](https://docs.langflow.org/configuration-authentication). |
Contributor
There was a problem hiding this comment.
🛠️ Refactor suggestion
Tighten wording & spell out the exact pre-conditions
- Mention that the issue only manifests when BOTH
LANGFLOW_AUTO_LOGIN=trueand authentication is enabled (LANGFLOW_AUTH_LOGIN=true), mirroring the behaviour fixed in 1.5.0. - Keep tense/voice consistent with the rest of the document (“Present tense, second-person” per docs guidelines).
- Avoid the contraction “don’t” in technical docs.
-In Langflow versions earlier than 1.5.0, if `LANGFLOW_AUTO_LOGIN` is set to `true`, Langflow automatically logs users in as a superuser without requiring authentication.
-In this case, API requests don't require a Langflow API key.
+In Langflow versions earlier than 1.5.0, when `LANGFLOW_AUTO_LOGIN=true` **and** authentication is enabled (`LANGFLOW_AUTH_LOGIN=true`), Langflow automatically logs the user in as a superuser without prompting for credentials.
+As a result, API requests do not require a Langflow API key.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| In Langflow versions earlier than 1.5.0, if `LANGFLOW_AUTO_LOGIN` is set to `true`, Langflow automatically logs users in as a superuser without requiring authentication. | |
| In this case, API requests don't require a Langflow API key. | |
| To address, upgrade to >= 1.5.0. | |
| For more information, see [Authentication](https://docs.langflow.org/configuration-authentication). | |
| In Langflow versions earlier than 1.5.0, when `LANGFLOW_AUTO_LOGIN=true` **and** authentication is enabled (`LANGFLOW_AUTH_LOGIN=true`), Langflow automatically logs the user in as a superuser without prompting for credentials. | |
| As a result, API requests do not require a Langflow API key. | |
| To address, upgrade to >= 1.5.0. | |
| For more information, see [Authentication](https://docs.langflow.org/configuration-authentication). |
🤖 Prompt for AI Agents
In SECURITY.md around lines 55 to 60, clarify that the security issue occurs
only when both LANGFLOW_AUTO_LOGIN=true and LANGFLOW_AUTH_LOGIN=true are set,
reflecting the exact pre-conditions fixed in version 1.5.0. Rewrite the text to
use present tense and second-person voice consistently, and replace contractions
like "don't" with full forms such as "do not" to maintain a formal technical
tone.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
SECURITY.md (2)
53-53: Capitalize “Fixed” for consistency with prior headingsThe earlier section uses “(Fixed in 1.3.0)”. Staying consistent helps readers skim quickly.
-### No API key required if running Langflow with `LANGFLOW_AUTH_LOGIN=true` (fixed in 1.5.0) +### No API key required if running Langflow with `LANGFLOW_AUTH_LOGIN=true` (Fixed in 1.5.0)
58-60: Add a severity indicator and CVE/reference if availableFor security docs, stating a CVSS score or at least “Severity: High” (plus a CVE ID when issued) helps downstream consumers triage.
github-actions
bot
added
the
documentation
github-actions
bot
added
documentation
aimurphy
approved these changes
Jul 15, 2025
Collaborator
aimurphy
left a comment
aimurphy
left a comment
There was a problem hiding this comment.
Possible typo in the header otherwise lgtm
github-actions
bot
added
documentation
github-actions
bot
added
documentation
Contributor
|
Build successful! ✅ |
mendonk
commented
Jul 23, 2025
github-actions
bot
added
documentation
Contributor
|
Build successful! ✅ |
mendonk
commented
Jul 23, 2025
github-actions
bot
added
documentation
Contributor
|
Build successful! ✅ |
jordanrfrazier
approved these changes
Jul 23, 2025
mendonk
commented
Jul 23, 2025
github-actions
bot
added
documentation
Contributor
|
Build successful! ✅ |
lucaseduoli
pushed a commit
that referenced
this pull request
Jul 24, 2025
* langflow-auto-login-security-doc * trailing-space * auto-not-auth * clarify-new-behavior * env-var-default * security-md-and-var-names * Apply suggestions from code review * Update docs/docs/Configuration/environment-variables.mdx * Update docs/docs/Configuration/configuration-authentication.mdx --------- Co-authored-by: April I. Murphy <[email protected]>
2getsandesh
pushed a commit
to 2getsandesh/langflow-IBM
that referenced
this pull request
Aug 6, 2025
* langflow-auto-login-security-doc * trailing-space * auto-not-auth * clarify-new-behavior * env-var-default * security-md-and-var-names * Apply suggestions from code review * Update docs/docs/Configuration/environment-variables.mdx * Update docs/docs/Configuration/configuration-authentication.mdx --------- Co-authored-by: April I. Murphy <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Update the security notice so end users understand that they need to update to 1.5.0 if they're using the default behavior of auto_login=true.
Summary by CodeRabbit