open-webui/backend/open_webui
Classic298 ef43e81f9a
fix: MCP OAuth 2.1 token exchange and multi-node propagation (#20076)
* sequential

* zero default

* fix

* fix: preserve absolute paths in sqlite+sqlcipher URLs

Previously, the connection logic incorrectly stripped the leading slash
from `sqlite+sqlcipher` paths, forcibly converting absolute paths
(e.g., `sqlite+sqlcipher:////app/data.db`) into relative paths
(which became `app/data.db`). This caused database initialization failures
when using absolute paths, such as with Docker volume mounts.
This change removes the slash-stripping logic, ensuring that absolute
path conventions (starting with `/`) are respected while maintaining
support for relative paths (which do not start with `/`).

* fix: MCP OAuth 2.1 token exchange and multi-node propagation

Fix two MCP OAuth 2.1 bugs affecting tool server authentication:

1. Token exchange failing with duplicate credentials (#19823)
   - Removed explicit client_id/client_secret passing in handle_callback()
   - Authlib already has credentials configured during add_client(),
     passing them again caused concatenation (e.g., "ID1,ID1") and 401 errors
   - Added token validation to detect missing access_token and provide
     clear error messages instead of cryptic database constraint errors

2. OAuth clients not propagating across multi-node setups (#19901)
   - Updated get_client() and get_client_info() to auto-lazy-load
     OAuth clients from the Redis-synced TOOL_SERVER_CONNECTIONS config
   - Clients are now instantiated on-demand on any node that needs them

Fixes #19823, #19901

* Update db.py

* Update wrappers.py
2025-12-21 10:51:52 -05:00
..
data refac: mv backend files to /open_webui dir 2024-09-04 16:54:48 +02:00
internal fix: Fix handling of absolute paths for SQLCipher databases (#20074) 2025-12-21 09:18:20 -05:00
migrations refac: channel_file and knowledge table migration 2025-12-10 16:41:22 -05:00
models fix: consolidate psql cleanup logic and fix web add with cleanup (#20072) 2025-12-21 07:14:29 -05:00
retrieval refac 2025-12-20 18:12:03 +04:00
routers refac 2025-12-21 18:08:36 +04:00
socket chore: update langchain 1.2.0 (#19991) 2025-12-20 08:50:44 -05:00
static refac 2025-08-10 00:02:58 +04:00
storage chore/perf: Remove old SRC level log env vars with no impact (#20045) 2025-12-20 08:16:14 -05:00
test chore: format, lint 2025-07-16 15:23:18 +09:00
utils fix: MCP OAuth 2.1 token exchange and multi-node propagation (#20076) 2025-12-21 10:51:52 -05:00
__init__.py Update __init__.py 2025-04-15 09:55:35 +02:00
alembic.ini fix: Alembic CLI commands from failing 2025-08-15 04:17:47 -04:00
config.py feat: Apply WEB_SEARCH_CONCURRENT_REQUESTS to all search engines using semaphore (#20070) 2025-12-21 07:18:00 -05:00
constants.py feat/enh: optional password validation 2025-11-20 17:44:49 -05:00
env.py refac: PASSWORD_VALIDATION_REGEX_PATTERN 2025-12-21 13:49:54 +04:00
functions.py chore/perf: Remove old SRC level log env vars with no impact (#20045) 2025-12-20 08:16:14 -05:00
main.py fix: prevent ExternalReranker from blocking event loop during RAG queries (#20049) 2025-12-20 08:43:40 -05:00
tasks.py chore/perf: Remove old SRC level log env vars with no impact (#20045) 2025-12-20 08:16:14 -05:00