I have searched the existing issues and discussions.
I am using the latest version of Open WebUI.
Installation Method
Docker
Open WebUI Version
v0.6.5-ollama
Ollama Version (if applicable)
No response
Operating System
RHEL 9
Browser (if applicable)
No response
Confirmation
I have read and followed all instructions in README.md.
I am using the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have listed steps to reproduce the bug in detail.
Expected Behavior
Per trusted header configuration, one should be able to set the WEBUI_AUTH_TRUSTED_EMAIL_HEADER environment variable on a new open-webui deployment and any webapi call made with the header info set should be sufficient for authentication.
Originally created by @qhaas on GitHub (Apr 20, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/13090
### Check Existing Issues
- [x] I have searched the existing issues and discussions.
- [x] I am using the latest version of Open WebUI.
### Installation Method
Docker
### Open WebUI Version
v0.6.5-ollama
### Ollama Version (if applicable)
_No response_
### Operating System
RHEL 9
### Browser (if applicable)
_No response_
### Confirmation
- [x] I have read and followed all instructions in `README.md`.
- [x] I am using the latest version of **both** Open WebUI and Ollama.
- [x] I have included the browser console logs.
- [x] I have included the Docker container logs.
- [x] I have listed steps to reproduce the bug in detail.
### Expected Behavior
Per [trusted header configuration](https://docs.openwebui.com/features/sso/#trusted-header), one should be able to set the `WEBUI_AUTH_TRUSTED_EMAIL_HEADER` environment variable on a new open-webui deployment and any webapi call made with the header info set should be sufficient for authentication.
### Actual Behavior
A list of all models returned [with this webapi call](https://docs.openwebui.com/getting-started/api-endpoints#-retrieve-all-models)
### Steps to Reproduce
1. Start container: `docker run --rm -d --name open-webui -p 127.0.0.1:8080:8080 -e WEBUI_AUTH_TRUSTED_EMAIL_HEADER='X-User-Email' ghcr.io/open-webui/open-webui:v0.6.5-ollama`
2. Run webapi call with header set: `curl -s -H "X-User-Email: admin@localhost" http://127.0.0.1:8080/api/models`
### Logs & Screenshots
$ docker run --rm -d --name open-webui -p 127.0.0.1:8080:8080 -e WEBUI_AUTH_TRUSTED_EMAIL_HEADER='X-User-Email' ghcr.io/open-webui/open-webui:v0.6.5-ollama
$ curl -s -H "X-User-Email: admin@localhost" http://127.0.0.1:8080/api/models | jq
{
"detail": "Not authenticated"
}
### Additional Information
[open-webui-logs.txt](https://github.com/user-attachments/files/19826941/open-webui-logs.txt)
GiteaMirror
added the bug label 2026-05-18 01:21:08 -05:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @qhaas on GitHub (Apr 20, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/13090
Check Existing Issues
Installation Method
Docker
Open WebUI Version
v0.6.5-ollama
Ollama Version (if applicable)
No response
Operating System
RHEL 9
Browser (if applicable)
No response
Confirmation
README.md.Expected Behavior
Per trusted header configuration, one should be able to set the
WEBUI_AUTH_TRUSTED_EMAIL_HEADERenvironment variable on a new open-webui deployment and any webapi call made with the header info set should be sufficient for authentication.Actual Behavior
A list of all models returned with this webapi call
Steps to Reproduce
docker run --rm -d --name open-webui -p 127.0.0.1:8080:8080 -e WEBUI_AUTH_TRUSTED_EMAIL_HEADER='X-User-Email' ghcr.io/open-webui/open-webui:v0.6.5-ollamacurl -s -H "X-User-Email: admin@localhost" http://127.0.0.1:8080/api/modelsLogs & Screenshots
$ docker run --rm -d --name open-webui -p 127.0.0.1:8080:8080 -e WEBUI_AUTH_TRUSTED_EMAIL_HEADER='X-User-Email' ghcr.io/open-webui/open-webui:v0.6.5-ollama
$ curl -s -H "X-User-Email: admin@localhost" http://127.0.0.1:8080/api/models | jq
{
"detail": "Not authenticated"
}
Additional Information
open-webui-logs.txt