github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-11-09 10:50:35 -06:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

fix: deprecation warnings when refreshing OAuth tokens with a client secret (#33700)

Browse Source 
Refreshing an OAuth token, or checking a token's client during token exchange, with the client secret sent over HTTP Basic logged aiohttp deprecation warnings on every call. aiohttp removes the deprecated helper in 4.0, after which these requests would fail. The Authorization header is now built with aiohttp's recommended replacement, and what the provider receives is unchanged. Fixes #33297
This commit is contained in:
Classic298
2026-11-04 06:00:36 +09:00
committed by GitHub
parent 8d7b71f6cc
commit 623257af76
2 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/open_webui/routers/auths.py
+4 -2
View File
@@ -10,7 +10,7 @@ import uuid
from ssl import CERT_NONE, CERT_REQUIRED, PROTOCOL_TLS
import jwt
from aiohttp import BasicAuth, ClientSession
from aiohttp import ClientSession, encode_basic_auth
from fastapi import APIRouter, Depends, HTTPException, Request, status
from fastapi.responses import JSONResponse, Response
from ldap3 import NONE, Connection, Server, Tls
@@ -1571,7 +1571,9 @@ async def get_token_client_id(client, token: str) -> str | None:
async with session.post(
introspection_endpoint,
data={'token': token, 'token_type_hint': 'access_token'},
auth=BasicAuth(client.client_id, client.client_secret or ''),
headers={
'Authorization': encode_basic_auth(client.client_id, client.client_secret or '', encoding='latin1')
},
ssl=AIOHTTP_CLIENT_SESSION_SSL,
) as r:
if r.status != 200:
backend/open_webui/utils/oauth.py
+10 -8
View File
@@ -1191,10 +1191,12 @@ class OAuthClientManager:
if should_send_oauth_resource(client_info):
refresh_data['resource'] = client_info.resource
client_auth = None
refresh_headers = {'Content-Type': 'application/x-www-form-urlencoded'}
if hasattr(client, 'client_secret') and client.client_secret:
if client.client_kwargs.get('token_endpoint_auth_method') == 'client_secret_basic':
client_auth = aiohttp.BasicAuth(client.client_id, client.client_secret)
refresh_headers['Authorization'] = aiohttp.encode_basic_auth(
client.client_id, client.client_secret, encoding='latin1'
)
# Some providers reject a body client_id next to Basic as a second credential (#19415)
del refresh_data['client_id']
else:
@@ -1213,8 +1215,7 @@ class OAuthClientManager:
async with session_http.post(
token_endpoint,
data=refresh_data,
auth=client_auth,
headers={'Content-Type': 'application/x-www-form-urlencoded'},
headers=refresh_headers,
ssl=AIOHTTP_CLIENT_SESSION_SSL,
) as r:
if r.status == 200:
@@ -1559,11 +1560,13 @@ class OAuthManager:
'refresh_token': token_data['refresh_token'],
'client_id': client.client_id,
}
client_auth = None
refresh_headers = {'Content-Type': 'application/x-www-form-urlencoded'}
# Add client_secret if available (some providers require it)
if hasattr(client, 'client_secret') and client.client_secret:
if client.client_kwargs.get('token_endpoint_auth_method') == 'client_secret_basic':
client_auth = aiohttp.BasicAuth(client.client_id, client.client_secret)
refresh_headers['Authorization'] = aiohttp.encode_basic_auth(
client.client_id, client.client_secret, encoding='latin1'
)
if not OAUTH_ACCESS_TOKEN_REQUEST_INCLUDE_CLIENT_ID:
del refresh_data['client_id']
else:
@@ -1582,8 +1585,7 @@ class OAuthManager:
async with session_http.post(
token_endpoint,
data=refresh_data,
auth=client_auth,
headers={'Content-Type': 'application/x-www-form-urlencoded'},
headers=refresh_headers,
ssl=AIOHTTP_CLIENT_SESSION_SSL,
) as r:
if r.status == 200: