ti.sil/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2025-12-11 20:05:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix: jwt token exposed in url

Browse source
This commit is contained in:
Timothy Jaeryang Baek 2025-08-06 21:02:54 +04:00
parent 041da26756
commit 0912a023c2
2 changed files with 12 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
backend/open_webui/utils/oauth.py
View file

@ -520,7 +520,7 @@ class OAuthManager:
response.set_cookie( response.set_cookie(
key="token", key="token",
value=jwt_token, value=jwt_token,
httponly=True, # Ensures the cookie is not accessible via JavaScript httponly=False, # Required for frontend access
samesite=WEBUI_AUTH_COOKIE_SAME_SITE, samesite=WEBUI_AUTH_COOKIE_SAME_SITE,
secure=WEBUI_AUTH_COOKIE_SECURE, secure=WEBUI_AUTH_COOKIE_SECURE,
) )
@ -539,6 +539,6 @@ class OAuthManager:
redirect_base_url = str(request.app.state.config.WEBUI_URL or request.base_url) redirect_base_url = str(request.app.state.config.WEBUI_URL or request.base_url)
if redirect_base_url.endswith("/"): if redirect_base_url.endswith("/"):
redirect_base_url = redirect_base_url[:-1] redirect_base_url = redirect_base_url[:-1]
redirect_url = f"{redirect_base_url}/auth#token={jwt_token}" redirect_url = f"{redirect_base_url}/auth"
return RedirectResponse(url=redirect_url, headers=response.headers) return RedirectResponse(url=redirect_url, headers=response.headers)

18
src/routes/auth/+page.svelte
View file

@ -101,18 +101,19 @@
}; };
const checkOauthCallback = async () => { const checkOauthCallback = async () => {
if (!$page.url.hash) { // Get the value of the 'token' cookie
return; function getCookie(name) {
const match = document.cookie.match(
new RegExp('(?:^|; )' + name.replace(/([.$?*|{}()[\]\\/+^])/g, '\\$1') + '=([^;]*)')
);
return match ? decodeURIComponent(match[1]) : null;
} }
const hash = $page.url.hash.substring(1);
if (!hash) { const token = getCookie('token');
return;
}
const params = new URLSearchParams(hash);
const token = params.get('token');
if (!token) { if (!token) {
return; return;
} }
const sessionUser = await getSessionUser(token).catch((error) => { const sessionUser = await getSessionUser(token).catch((error) => {
toast.error(`${error}`); toast.error(`${error}`);
return null; return null;
@ -120,6 +121,7 @@
if (!sessionUser) { if (!sessionUser) {
return; return;
} }
localStorage.token = token; localStorage.token = token;
await setSessionUser(sessionUser); await setSessionUser(sessionUser);
}; };