ti.sil/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2025-12-11 20:05:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

refac

Browse source
This commit is contained in:
Timothy Jaeryang Baek 2025-09-08 14:18:25 +04:00
parent a28ca30519
commit 91755309ce
4 changed files with 30 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
backend/open_webui/env.py
View file

@ -465,6 +465,10 @@ ENABLE_COMPRESSION_MIDDLEWARE = (
os.environ.get("ENABLE_COMPRESSION_MIDDLEWARE", "True").lower() == "true" os.environ.get("ENABLE_COMPRESSION_MIDDLEWARE", "True").lower() == "true"
) )
ENABLE_OAUTH_SESSION_TOKENS_COOKIES = (
os.environ.get("ENABLE_OAUTH_SESSION_TOKENS_COOKIES", "True").lower() == "true"
)
#################################### ####################################
# SCIM Configuration # SCIM Configuration

8
backend/open_webui/routers/auths.py
View file

@ -28,6 +28,7 @@ from open_webui.env import (
WEBUI_AUTH_TRUSTED_GROUPS_HEADER, WEBUI_AUTH_TRUSTED_GROUPS_HEADER,
WEBUI_AUTH_COOKIE_SAME_SITE, WEBUI_AUTH_COOKIE_SAME_SITE,
WEBUI_AUTH_COOKIE_SECURE, WEBUI_AUTH_COOKIE_SECURE,
ENABLE_OAUTH_SESSION_TOKENS_COOKIES,
WEBUI_AUTH_SIGNOUT_REDIRECT_URL, WEBUI_AUTH_SIGNOUT_REDIRECT_URL,
ENABLE_INITIAL_ADMIN_SIGNUP, ENABLE_INITIAL_ADMIN_SIGNUP,
SRC_LOG_LEVELS, SRC_LOG_LEVELS,
@ -678,6 +679,7 @@ async def signout(request: Request, response: Response):
response.delete_cookie("oui-session") response.delete_cookie("oui-session")
if ENABLE_OAUTH_SIGNUP.value: if ENABLE_OAUTH_SIGNUP.value:
# TODO: update this to use oauth_session_tokens in User Object
oauth_id_token = request.cookies.get("oauth_id_token") oauth_id_token = request.cookies.get("oauth_id_token")
if oauth_id_token and OPENID_PROVIDER_URL.value: if oauth_id_token and OPENID_PROVIDER_URL.value:
try: try:
@ -687,7 +689,11 @@ async def signout(request: Request, response: Response):
openid_data = await resp.json() openid_data = await resp.json()
logout_url = openid_data.get("end_session_endpoint") logout_url = openid_data.get("end_session_endpoint")
if logout_url: if logout_url:
response.delete_cookie("oauth_id_token")
if ENABLE_OAUTH_SESSION_TOKENS_COOKIES:
response.delete_cookie("oauth_id_token")
response.delete_cookie("oauth_access_token")
response.delete_cookie("oauth_refresh_token")
return JSONResponse( return JSONResponse(
status_code=200, status_code=200,

6
backend/open_webui/utils/auth.py
View file

@ -285,8 +285,14 @@ def get_current_user(
# Delete the token cookie # Delete the token cookie
response.delete_cookie("token") response.delete_cookie("token")
# Delete OAuth token if present # Delete OAuth token if present
if request.cookies.get("oauth_id_token"): if request.cookies.get("oauth_id_token"):
response.delete_cookie("oauth_id_token") response.delete_cookie("oauth_id_token")
if request.cookies.get("oauth_access_token"):
response.delete_cookie("oauth_access_token")
if request.cookies.get("oauth_refresh_token"):
response.delete_cookie("oauth_refresh_token")
raise HTTPException( raise HTTPException(
status_code=status.HTTP_401_UNAUTHORIZED, status_code=status.HTTP_401_UNAUTHORIZED,
detail="User mismatch. Please sign in again.", detail="User mismatch. Please sign in again.",

16
backend/open_webui/utils/oauth.py
View file

@ -626,6 +626,15 @@ class OAuthManager:
) )
if ENABLE_OAUTH_SIGNUP.value: if ENABLE_OAUTH_SIGNUP.value:
oauth_id_token = token.get("id_token")
response.set_cookie(
key="oauth_id_token",
value=oauth_id_token,
httponly=True,
samesite=WEBUI_AUTH_COOKIE_SAME_SITE,
secure=WEBUI_AUTH_COOKIE_SECURE,
)
oauth_access_token = token.get("access_token") oauth_access_token = token.get("access_token")
response.set_cookie( response.set_cookie(
key="oauth_access_token", key="oauth_access_token",
@ -635,12 +644,13 @@ class OAuthManager:
secure=WEBUI_AUTH_COOKIE_SECURE, secure=WEBUI_AUTH_COOKIE_SECURE,
) )
oauth_id_token = token.get("id_token") oauth_refresh_token = token.get("refresh_token")
response.set_cookie( response.set_cookie(
key="oauth_id_token", key="oauth_refresh_token",
value=oauth_id_token, value=oauth_refresh_token,
httponly=True, httponly=True,
samesite=WEBUI_AUTH_COOKIE_SAME_SITE, samesite=WEBUI_AUTH_COOKIE_SAME_SITE,
secure=WEBUI_AUTH_COOKIE_SECURE, secure=WEBUI_AUTH_COOKIE_SECURE,
) )
return response return response