fix: resolve multi-user session hijacking in LinkedIn agent#132
Open
SunkariManwithaGopal wants to merge 1 commit into
Open
fix: resolve multi-user session hijacking in LinkedIn agent#132SunkariManwithaGopal wants to merge 1 commit into
SunkariManwithaGopal wants to merge 1 commit into
Conversation
Replace global LinkedInAgent singleton with per-sender session management. Each incoming sender now gets an isolated LinkedInAgent instance via a user_sessions dictionary, preventing cross-user state corruption of auth flows (connection_request, connected_account, user_id). Fixes BOLA / session hijacking vulnerability where concurrent users could overwrite each other's LinkedIn credentials and execute actions on another user's account.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #130
Replace global LinkedInAgent singleton with per-sender session management. Each incoming sender now gets an isolated LinkedInAgent instance via a user_sessions dictionary, preventing cross-user state corruption of auth flows (connection_request, connected_account, user_id). Fixes BOLA / session hijacking vulnerability where concurrent users could overwrite each other's LinkedIn credentials and execute actions on another user's account.
Summary
Describe what this PR changes.
Type of Change
Checklist
contributors/<agent-name>/(not repo root).ruff check ..ruff format ..README.mdfor changed example(s)..env.exampleif environment variables are required.contributors/CHANGELOG.mdfor community agent changes, or rootCHANGELOG.mdfor other non-doc changes.README.md(if new agent).review-requiredCI).Related Issue
Link issue number(s), if any:
Notes for Reviewers
Anything reviewers should focus on.