open-webui

mirror of https://github.com/open-webui/open-webui.git synced 2026-08-13 01:02:25 -06:00

Files

T

Classic298 3a9b9a1a74 fix: resolve terminal system_oauth token server-side instead of trusting a client header (#26719 )

The terminal proxy's system_oauth auth type read the OAuth access token from the client-supplied x-oauth-access-token request header and forwarded it verbatim as a Bearer token to the upstream terminal server, so an authenticated caller could substitute an arbitrary token for the one bound to their own session. Resolve the token server-side from the caller's OAuth session via oauth_manager.get_oauth_token(user.id, oauth_session_id), matching the openai.py proxy, so the forwarded token is always the one Open WebUI issued for the authenticated user and the client header is ignored.

Co-authored-by: brodmart <brodmart@users.noreply.github.com>

2026-07-27 02:07:34 -04:00

data

…

open_webui

fix: resolve terminal system_oauth token server-side instead of trusting a client header (#26719 )

2026-07-27 02:07:34 -04:00

.dockerignore

…

.gitignore

refac

2024-09-06 04:59:20 +02:00

dev.sh