Security issue when create agent is called from different user simultaneously

[Sapessii]

Describe the bug

Hi, when the create agent endpoint is called simultaneously from different users, the user_id is always stick with the first user, hence resulting in multiple users that can access to the chat of others.

I think it's related with the middleware setting the set_current_user function is called.

[cpacker]

Thanks for bringing this up @Sapessii ! Just opened a fix in PR #1834 - once it passes test will get it merged in ASAP.

[Sapessii]

Awesome thank you so much!

[Sapessii]

Hi! @cpacker, I just tried the fix but is not getting the header correctly, it's working when using

user_id: str = Header(..., alias="user_id")

[cpacker]

@Sapessii my understanding of FastAPI code is that alias shouldn't be required in this case since user_id is the variable name + header key name. Similarly, if we go from None to ..., I believe that means that user_id now becomes required in the header, vs being optional.

Testing now to see if I can repro (thanks for the report!)

[Sapessii]

@cpacker sure no problem :) thanks to you!

[cpacker]

@Sapessii can you check my comments in #1843?

I think this seems to be working (at least in that PR). Will merge it in shortly.

[Sapessii]

@cpacker working perfectly! thank you so much