Insecure Cache Algorithms

[anand]

Hi Community,
I have built a prompt application with nest + langChain, It is throwing a warning saying:
“The default method for hashing keys is insecure and will be replaced in a future version, but hasn’t been replaced yet as to not break existing caches. It’s recommended that you use a more secure hashing algorithm to avoid cache poisoning“.

to resolve it have build a redisClient to replace default in memory caching and then used client.makeDefaultKeyEncoder(sha256); to create a secure hash key, as suggested in trouble shoot document ( Insecure Cache Algorithms | 🦜️🔗 Langchain ) and caching document ( How to cache chat model responses | 🦜️🔗 Langchain ).

here is my implementation:

and then passed it to the model.
I can see that the data is getting stored to redis and caching is working but the warning still remains.

can someone please help me a solution.

[hntrl]

Hey @anand! Thanks for flagging this.

This was a security related change that we made a few months ago, but it looks like we never adopted the new cache key getter within the caches we maintain (whoops!)

Will work to fix this, you can track the status of the change here: fix: use `keyEncoder` instead of insecure cache key getter by hntrl · Pull Request #8978 · langchain-ai/langchainjs · GitHub