Description
When dataPersistence is enabled but requireLogin is false, the behavior for anonymous users is inconsistent:
- Frontend: The thread history sidebar is hidden because the rendering logic requires
requireLogin.
- Backend: The
get_current_user function returns None for anonymous users, causing /project/threads to return a 401 Unauthorized error, even though anonymous threads are successfully created in the data layer.
This breaks the "persistent anonymous chat" use case: messages are stored, but the user cannot retrieve or resume them.
Steps to Reproduce
- Configure Chainlit with
dataPersistence: true and requireLogin: false.
- Open the UI as an anonymous user.
- Send a message (a thread is created in the database).
- Attempt to open the sidebar history (entry is not rendered).
- Call
POST /project/threads without authentication (returns 401).
Expected Behavior
Either:
- Anonymous users should be able to list and resume their threads when
dataPersistence is enabled.
- OR the framework should explicitly document that
dataPersistence requires requireLogin and prevent anonymous thread creation.
Actual Behavior
Persistence works partially (creation), but retrieval fails, leading to a confusing user experience.
Environment
- Chainlit version: 2.11.1
- Frontend:
frontend/dist/assets/index-*.js
- Backend:
chainlit/auth/__init__.py, chainlit/socket.py
Possible Fix
If anonymous persistence is intended:
- Frontend: Update rendering logic to rely only on
dataPersistence.
- Backend: Modify
get_current_user to return an anonymous User object when login is not required:
if not require_login():
return User(identifier="anonymous", metadata={"role": "anonymous"})
Description
When
dataPersistenceis enabled butrequireLoginis false, the behavior for anonymous users is inconsistent:requireLogin.get_current_userfunction returnsNonefor anonymous users, causing/project/threadsto return a 401 Unauthorized error, even though anonymous threads are successfully created in the data layer.This breaks the "persistent anonymous chat" use case: messages are stored, but the user cannot retrieve or resume them.
Steps to Reproduce
dataPersistence: trueandrequireLogin: false.POST /project/threadswithout authentication (returns 401).Expected Behavior
Either:
dataPersistenceis enabled.dataPersistencerequiresrequireLoginand prevent anonymous thread creation.Actual Behavior
Persistence works partially (creation), but retrieval fails, leading to a confusing user experience.
Environment
frontend/dist/assets/index-*.jschainlit/auth/__init__.py,chainlit/socket.pyPossible Fix
If anonymous persistence is intended:
dataPersistence.get_current_userto return an anonymousUserobject when login is not required: