danny-avila/LibreChat · error

User ID not found in blob path

Error message

User ID not found in blob path

What it means

Thrown by deleteFileFromAzure (Azure/crud.js) as an authorization guard: the blob path derived from file.filepath must contain req.user.id before a delete is issued. This prevents one user from deleting another user's blob by manipulating a file reference.

Source

Thrown at api/server/services/Files/Azure/crud.js:130

    throw error;
  }
}

/**
 * Deletes a blob from Azure Blob Storage.
 *
 * @param {Object} params
 * @param {ServerRequest} params.req - The Express request object.
 * @param {MongoFile} params.file - The file object.
 */
async function deleteFileFromAzure(req, file) {
  await deleteRagFile({ userId: req.user.id, file });

  try {
    const containerClient = await getAzureContainerClient(AZURE_CONTAINER_NAME);
    const blobPath = file.filepath.split(`${AZURE_CONTAINER_NAME}/`)[1];
    if (!blobPath.includes(req.user.id)) {
      throw new Error('User ID not found in blob path');
    }
    const blockBlobClient = containerClient.getBlockBlobClient(blobPath);
    await blockBlobClient.delete();
    logger.debug('[deleteFileFromAzure] Blob deleted successfully from Azure Blob Storage');
  } catch (error) {
    logger.error('[deleteFileFromAzure] Error deleting blob:', error);
    if (error.statusCode === 404) {
      return;
    }
    throw error;
  }
}

/**
 * Streams a file from disk directly to Azure Blob Storage without loading
 * the entire file into memory.
 *
 * @param {Object} params

View on GitHub (pinned to 5ff282f900)

Solutions

1. Verify file.filepath matches the expected layout `{basePath}/{userId}/{fileName}` and that userId is present.
2. Confirm AZURE_CONTAINER_NAME matches the container used when the file was originally stored.
3. For shared/admin deletions, route through a privileged path that intentionally bypasses this ownership check.
4. Audit the File document in MongoDB to ensure filepath wasn't overwritten by a bad migration.

// Confirm ownership layout before delegating to deleteFileFromAzure
const expected = `${AZURE_CONTAINER_NAME}/${basePath}/${req.user.id}/`;
if (!file.filepath || !file.filepath.startsWith(expected)) {
  throw new Error('File path does not belong to this user');
}

try {
  await deleteFileFromAzure(req, file);
} catch (err) {
  if (/User ID not found in blob path/.test(err.message)) {
    return res.status(403).json({ message: 'Not authorized to delete this file' });
  }
  throw err;
}

When it happens

Trigger: file.filepath split on `${AZURE_CONTAINER_NAME}/` yields a suffix that does not include req.user.id — e.g. a cross-user file reference, a path stored without the userId segment, or a container-name mismatch.

Common situations: AZURE_CONTAINER_NAME env var changed after files were stored (so the split produces the wrong suffix); a file record was migrated/imported without the canonical {basePath}/{userId}/{fileName} layout; an attempt to delete a shared/system file through a user-scoped handler.

Related errors

• Failed to fetch URL: ${response.status} ${response.statusTex
• Remote file response too large: ${buffer.length} bytes
• Invalid file path
• Invalid file path
• This tool is only available for agents.

AI-assisted analysis of danny-avila/LibreChat@5ff282f900 (2026-08-12). Data as JSON: /api/errors/1ce7dee60e9a24f0. Report an issue: GitHub.