NocoDB SSO Is a Licensed Feature — and the Env Vars Won't Tell You

Описание и применение

В неавторизованном экземпляре NocoDB включение OIDC SSO приводит к аварийному завершению сервера, создавая риск отказа в обслуживании и вводя в заблуждение пользователей относительно лицензирования.

Задача

Enabling OIDC SSO on an unlicensed self‑hosted NocoDB instance crashes the server, creating a denial‑of‑service risk and misleading users about licensing.

Результат

An unauthenticated request to the OIDC callback route on an unlicensed NocoDB instance terminates the server, exposing a denial‑of‑service vector and revealing that OIDC SSO is a paid feature.

Рабочий процесс

• 1. Pull the NocoDB image. 2. Start a throwaway container with SQLite metadata store and set the six OIDC environment variables. 3. Observe the startup log: "No license key found — running in CE mode". 4. Send an unauthenticated GET to /auth/oidc. 5. The container exits with exit code 1 and the OIDC route is no longer available.
• 6. Verify the container is stopped with docker ps -a.

Доказательства

NocoDB's OIDC SSO is a paid feature.

Источник

The route that handles the OIDC callback is reachable without authentication — it has to be, that's how a login flow starts.

Источник

No license key found — running in CE mode

Источник

UNCAUGHT EXCEPTION ### unhandledRejection TypeError: _0x418c23 is not a function at docker/index.js:1:27483406

Источник