diff --git a/backend/open_webui/retrieval/loaders/mistral.py b/backend/open_webui/retrieval/loaders/mistral.py index e46863a96a..b3d274ee7c 100644 --- a/backend/open_webui/retrieval/loaders/mistral.py +++ b/backend/open_webui/retrieval/loaders/mistral.py @@ -9,7 +9,7 @@ from typing import List, Dict, Any from contextlib import asynccontextmanager from langchain_core.documents import Document -from open_webui.env import GLOBAL_LOG_LEVEL +from open_webui.env import GLOBAL_LOG_LEVEL, AIOHTTP_CLIENT_SESSION_SSL logging.basicConfig(stream=sys.stdout, level=GLOBAL_LOG_LEVEL) log = logging.getLogger(__name__) @@ -285,6 +285,7 @@ class MistralLoader: data=writer, headers=self.headers, timeout=aiohttp.ClientTimeout(total=self.upload_timeout), + ssl=AIOHTTP_CLIENT_SESSION_SSL, ) as response: return await self._handle_response_async(response) @@ -333,6 +334,7 @@ class MistralLoader: headers=headers, params=params, timeout=aiohttp.ClientTimeout(total=self.url_timeout), + ssl=AIOHTTP_CLIENT_SESSION_SSL, ) as response: return await self._handle_response_async(response) @@ -404,6 +406,7 @@ class MistralLoader: json=payload, headers=headers, timeout=aiohttp.ClientTimeout(total=self.ocr_timeout), + ssl=AIOHTTP_CLIENT_SESSION_SSL, ) as response: ocr_response = await self._handle_response_async(response) @@ -436,7 +439,8 @@ class MistralLoader: async with session.delete( url=f'{self.base_url}/files/{file_id}', headers=self.headers, - timeout=aiohttp.ClientTimeout(total=self.cleanup_timeout), # Shorter timeout for cleanup + timeout=aiohttp.ClientTimeout(total=self.cleanup_timeout), + ssl=AIOHTTP_CLIENT_SESSION_SSL, ) as response: return await self._handle_response_async(response) diff --git a/backend/open_webui/retrieval/web/utils.py b/backend/open_webui/retrieval/web/utils.py index cfe0f71b85..cd5c3a946d 100644 --- a/backend/open_webui/retrieval/web/utils.py +++ b/backend/open_webui/retrieval/web/utils.py @@ -45,6 +45,7 @@ from open_webui.config import ( WEB_FETCH_FILTER_LIST, ) from open_webui.utils.misc import is_string_allowed +from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL log = logging.getLogger(__name__) @@ -511,6 +512,8 @@ class SafeWebBaseLoader(WebBaseLoader): ) if not self.session.verify: kwargs['ssl'] = False + else: + kwargs['ssl'] = AIOHTTP_CLIENT_SESSION_SSL async with session.get( url, diff --git a/backend/open_webui/routers/audio.py b/backend/open_webui/routers/audio.py index 42327059e6..5260bd873c 100644 --- a/backend/open_webui/routers/audio.py +++ b/backend/open_webui/routers/audio.py @@ -1304,6 +1304,7 @@ async def get_available_models(request: Request) -> list[dict]: try: async with session.get( f'{request.app.state.config.TTS_OPENAI_API_BASE_URL}/audio/models', + ssl=AIOHTTP_CLIENT_SESSION_SSL, ) as response: response.raise_for_status() data = await response.json() @@ -1315,6 +1316,7 @@ async def get_available_models(request: Request) -> list[dict]: try: async with session.get( f'{request.app.state.config.TTS_OPENAI_API_BASE_URL}/models', + ssl=AIOHTTP_CLIENT_SESSION_SSL, ) as response: response.raise_for_status() data = await response.json() @@ -1335,6 +1337,7 @@ async def get_available_models(request: Request) -> list[dict]: 'xi-api-key': request.app.state.config.TTS_API_KEY, 'Content-Type': 'application/json', }, + ssl=AIOHTTP_CLIENT_SESSION_SSL, ) as response: response.raise_for_status() models = await response.json() @@ -1362,6 +1365,7 @@ async def get_available_voices(request) -> dict: async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session: async with session.get( f'{request.app.state.config.TTS_OPENAI_API_BASE_URL}/audio/voices', + ssl=AIOHTTP_CLIENT_SESSION_SSL, ) as response: response.raise_for_status() data = await response.json() @@ -1401,7 +1405,7 @@ async def get_available_voices(request) -> dict: timeout = aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST) async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session: - async with session.get(url, headers=headers) as response: + async with session.get(url, headers=headers, ssl=AIOHTTP_CLIENT_SESSION_SSL) as response: response.raise_for_status() voices = await response.json() @@ -1422,6 +1426,7 @@ async def get_available_voices(request) -> dict: headers={ 'Authorization': f'Bearer {api_key}', }, + ssl=AIOHTTP_CLIENT_SESSION_SSL, ) as response: response.raise_for_status() voices_data = await response.json() @@ -1456,6 +1461,7 @@ async def get_elevenlabs_voices(api_key: str) -> dict: 'xi-api-key': api_key, 'Content-Type': 'application/json', }, + ssl=AIOHTTP_CLIENT_SESSION_SSL, ) as response: response.raise_for_status() voices_data = await response.json() diff --git a/backend/open_webui/routers/auths.py b/backend/open_webui/routers/auths.py index d3337d8109..2a6f0f6dcd 100644 --- a/backend/open_webui/routers/auths.py +++ b/backend/open_webui/routers/auths.py @@ -810,7 +810,7 @@ async def signout(request: Request, response: Response, db: AsyncSession = Depen oauth_id_token = session.token.get('id_token') try: async with ClientSession(trust_env=True) as session: - async with session.get(oauth_server_metadata_url) as r: + async with session.get(oauth_server_metadata_url, ssl=AIOHTTP_CLIENT_SESSION_SSL) as r: if r.status == 200: openid_data = await r.json() logout_url = openid_data.get('end_session_endpoint') diff --git a/backend/open_webui/routers/configs.py b/backend/open_webui/routers/configs.py index 7c54c09039..68e1d129dc 100644 --- a/backend/open_webui/routers/configs.py +++ b/backend/open_webui/routers/configs.py @@ -6,7 +6,7 @@ import aiohttp from typing import Optional -from open_webui.env import AIOHTTP_CLIENT_TIMEOUT +from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL, AIOHTTP_CLIENT_TIMEOUT from open_webui.utils.auth import get_admin_user, get_verified_user from open_webui.config import get_config, save_config, async_save_config from open_webui.config import BannerModel @@ -293,7 +293,7 @@ async def verify_terminal_server_connection( ) as session: # Orchestrators expose a policies API; plain terminals don't. try: - async with session.get(f'{base_url}/api/v1/policies', headers=headers) as resp: + async with session.get(f'{base_url}/api/v1/policies', headers=headers, ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp: if resp.ok: return {'status': True, 'type': 'orchestrator'} except Exception: @@ -301,7 +301,7 @@ async def verify_terminal_server_connection( # Fall back to open-terminal config endpoint. try: - async with session.get(f'{base_url}/api/config', headers=headers) as resp: + async with session.get(f'{base_url}/api/config', headers=headers, ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp: if resp.ok: return {'status': True, 'type': 'terminal'} except Exception: @@ -342,7 +342,7 @@ async def put_terminal_server_policy( timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT), ) as session: policy_url = f'{base_url}/api/v1/policies/{form_data.policy_id}' - async with session.put(policy_url, headers=headers, json=form_data.policy_data) as resp: + async with session.put(policy_url, headers=headers, json=form_data.policy_data, ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp: if resp.ok: return await resp.json() detail = await resp.text() @@ -369,7 +369,7 @@ async def verify_tool_servers_config(request: Request, form_data: ToolServerConn trust_env=True, timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT), ) as session: - async with session.get(discovery_url) as oauth_server_metadata_response: + async with session.get(discovery_url, ssl=AIOHTTP_CLIENT_SESSION_SSL) as oauth_server_metadata_response: if oauth_server_metadata_response.status == 200: try: oauth_server_metadata = OAuthMetadata.model_validate( diff --git a/backend/open_webui/utils/automations.py b/backend/open_webui/utils/automations.py index 41486cd21c..0c6e4e969a 100644 --- a/backend/open_webui/utils/automations.py +++ b/backend/open_webui/utils/automations.py @@ -272,6 +272,7 @@ async def _set_terminal_cwd(app, server_id: str, user, cwd: str, chat_id: str) - handled correctly — same path the frontend uses. """ import aiohttp + from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL connections = getattr(getattr(app, 'state', None), 'config', None) if connections is None: @@ -307,6 +308,7 @@ async def _set_terminal_cwd(app, server_id: str, user, cwd: str, chat_id: str) - target_url, json={'path': cwd}, headers=headers, + ssl=AIOHTTP_CLIENT_SESSION_SSL, ) as resp: if resp.status != 200: body = await resp.text() diff --git a/backend/open_webui/utils/tools.py b/backend/open_webui/utils/tools.py index 471ec8540d..3f4eac7e91 100644 --- a/backend/open_webui/utils/tools.py +++ b/backend/open_webui/utils/tools.py @@ -44,6 +44,7 @@ from open_webui.utils.plugin import load_tool_module_by_id from open_webui.utils.access_control import has_access, has_connection_access from open_webui.config import BYPASS_ADMIN_ACCESS_CONTROL from open_webui.env import ( + AIOHTTP_CLIENT_SESSION_SSL, AIOHTTP_CLIENT_TIMEOUT, AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER, AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER_DATA, @@ -907,7 +908,7 @@ async def get_terminal_cwd( timeout=aiohttp.ClientTimeout(total=5), trust_env=True, ) as session: - async with session.get(cwd_url, headers=headers, cookies=cookies or {}) as resp: + async with session.get(cwd_url, headers=headers, cookies=cookies or {}, ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp: if resp.status == 200: data = await resp.json() return data.get('cwd') @@ -934,7 +935,7 @@ async def get_terminal_system_prompt( trust_env=True, ) as session: # 1. Check feature flag - async with session.get(f'{base}/api/config') as resp: + async with session.get(f'{base}/api/config', ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp: if resp.status != 200: return None config = await resp.json() @@ -942,7 +943,7 @@ async def get_terminal_system_prompt( return None # 2. Fetch system prompt - async with session.get(f'{base}/system', headers=headers, cookies=cookies or {}) as resp: + async with session.get(f'{base}/system', headers=headers, cookies=cookies or {}, ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp: if resp.status == 200: data = await resp.json() return data.get('prompt') diff --git a/backend/open_webui/utils/webhook.py b/backend/open_webui/utils/webhook.py index 11c94675d1..ee7f3ab3b2 100644 --- a/backend/open_webui/utils/webhook.py +++ b/backend/open_webui/utils/webhook.py @@ -3,7 +3,7 @@ import logging import aiohttp from open_webui.config import WEBUI_FAVICON_URL -from open_webui.env import AIOHTTP_CLIENT_TIMEOUT, VERSION +from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL, AIOHTTP_CLIENT_TIMEOUT, VERSION log = logging.getLogger(__name__) @@ -53,7 +53,7 @@ async def post_webhook(name: str, url: str, message: str, event_data: dict) -> b async with aiohttp.ClientSession( trust_env=True, timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT) ) as session: - async with session.post(url, json=payload) as r: + async with session.post(url, json=payload, ssl=AIOHTTP_CLIENT_SESSION_SSL) as r: r_text = await r.text() r.raise_for_status() log.debug(f'r.text: {r_text}')