NocoDB SSO Is a Licensed Feature — and the Env Vars Won't Tell You

说明与用途

在未授权的 NocoDB 实例上启用 OIDC SSO 会导致服务器崩溃，产生拒绝服务风险，并误导用户关于许可信息。

问题

Enabling OIDC SSO on an unlicensed self‑hosted NocoDB instance crashes the server, creating a denial‑of‑service risk and misleading users about licensing.

结果

An unauthenticated request to the OIDC callback route on an unlicensed NocoDB instance terminates the server, exposing a denial‑of‑service vector and revealing that OIDC SSO is a paid feature.

工作流

• 1. Pull the NocoDB image. 2. Start a throwaway container with SQLite metadata store and set the six OIDC environment variables. 3. Observe the startup log: "No license key found — running in CE mode". 4. Send an unauthenticated GET to /auth/oidc. 5. The container exits with exit code 1 and the OIDC route is no longer available.
• 6. Verify the container is stopped with docker ps -a.

证据

NocoDB's OIDC SSO is a paid feature.

来源

The route that handles the OIDC callback is reachable without authentication — it has to be, that's how a login flow starts.

来源

No license key found — running in CE mode

来源

UNCAUGHT EXCEPTION ### unhandledRejection TypeError: _0x418c23 is not a function at docker/index.js:1:27483406

来源