github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-08-30 17:25:30 -05:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

[PR #24828] [CLOSED] fix: skip MCP-provider sessions in SSO OAuth fallback to prevent session wipe (#24618) #115187

New Issue
Closed
opened 2026-05-18 16:08:26 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-05-18 16:08:26 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/24828
Author: @IVVI0927
Created: 5/17/2026
Status: ❌ Closed

Base: dev ← Head: fix/24618-mcp-oauth-session-wipe

📝 Commits (3)

  • f1ff554 fix: skip MCP-provider sessions in SSO OAuth fallback (#24618)
  • e8f9476 test: add regression coverage for MCP session filtering in SSO fallback (#24618)
  • cfb9c72 refactor: extract select_sso_session to oauth_session_utils; update tests to use real function (#24618)

📊 Changes

5 files changed (+140 additions, -2 deletions)

View changed files

➕ backend/open_webui/test/__init__.py (+0 -0)
➕ backend/open_webui/test/utils/__init__.py (+0 -0)
➕ backend/open_webui/test/utils/test_get_system_oauth_token.py (+117 -0)
📝 backend/open_webui/utils/middleware.py (+3 -2)
➕ backend/open_webui/utils/oauth_session_utils.py (+20 -0)

📄 Description

Pull Request Checklist

Note to first-time contributors: Please open a discussion post in Discussions to discuss your idea/fix with the community before creating a pull request, and describe your changes before submitting a pull request.

This is to ensure large feature PRs are discussed with the community first, before starting work on it. If the community does not want this feature or it is not relevant for Open WebUI as a project, it can be identified in the discussion before working on the feature and submitting the PR.

Before submitting, make sure you've checked the following:

  • Linked Issue/Discussion: This PR references an existing Issue or Discussion — Closes #___ / Relates to #___. If one does not exist, create one first. PRs without a linked issue or discussion may be closed without review.
  • Target branch: Verify that the pull request targets the dev branch. PRs targeting main will be immediately closed.
  • Description: Provide a concise description of the changes made in this pull request down below.
  • Changelog: Ensure a changelog entry following the format of Keep a Changelog is added at the bottom of the PR description.
  • Documentation: Add docs in Open WebUI Docs Repository. Document user-facing behavior, environment variables, public APIs/interfaces, or deployment steps.
  • Dependencies: Are there any new or upgraded dependencies? If so, explain why, update the changelog/docs, and include any compatibility notes. Actually run the code/function that uses updated library to ensure it doesn't crash.
  • Testing: Perform manual tests to verify the implemented fix/feature works as intended AND does not break any other functionality. Include reproducible steps to demonstrate the issue before the fix. Test edge cases (URL encoding, HTML entities, types). Take this as an opportunity to make screenshots of the feature/fix and include them in the PR description.
  • Agentic AI Code: Confirm this Pull Request is not written by any AI Agent or has at least gone through additional human review AND manual testing. If any AI Agent is the co-author of this PR, it may lead to immediate closure of the PR.
  • Code review: Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?
  • Design & Architecture: Prefer smart defaults over adding new settings; use local state for ephemeral UI logic. Open a Discussion for major architectural or UX changes.
  • Git Hygiene: Keep PRs atomic (one logical change). Clean up commits and rebase on dev to ensure no unrelated commits (e.g. from main) are included. Push updates to the existing PR branch instead of closing and reopening.
  • Title Prefix: To clearly categorize this pull request, prefix the pull request title using one of the following:
    • BREAKING CHANGE: Significant changes that may affect compatibility
    • build: Changes that affect the build system or external dependencies
    • ci: Changes to our continuous integration processes or workflows
    • chore: Refactor, cleanup, or other non-functional code changes
    • docs: Documentation update or addition
    • feat: Introduces a new feature or enhancement to the codebase
    • fix: Bug fix or error correction
    • i18n: Internationalization or localization changes
    • perf: Performance improvement
    • refactor: Code restructuring for better maintainability, readability, or scalability
    • style: Changes that do not affect the meaning of the code (white space, formatting, missing semi-colons, etc.)
    • test: Adding missing tests or correcting existing tests
    • WIP: Work in progress, a temporary label for incomplete or ongoing work

Changelog Entry

Description

Fixes incorrect deletion of MCP OAuth sessions after every chat completion. The SSO OAuth token fallback in get_system_oauth_token() previously picked the most recent OAuth session of the user regardless of provider — including mcp:* sessions — and handed them to the SSO oauth_manager, which doesn't recognise MCP providers and deletes the session after a failed refresh. MCP sessions are now filtered out of this fallback path; their refresh is already handled separately by oauth_client_manager.get_oauth_token() in process_chat_payload.

Added

  • backend/open_webui/utils/oauth_session_utils.py — lightweight module containing select_sso_session(), the helper that filters MCP sessions out of the SSO fallback path.
  • Regression test file backend/open_webui/test/utils/test_get_system_oauth_token.py with 6 cases covering the SSO/MCP session-filtering scenarios, exercising the real select_sso_session() function directly.

Changed

  • Extracted session-selection logic into a new lightweight module backend/open_webui/utils/oauth_session_utils.py (select_sso_session()), keeping it importable without pulling in the full middleware chain.
  • get_system_oauth_token() in backend/open_webui/utils/middleware.py now delegates fallback session selection to select_sso_session(), which filters out mcp:* sessions before passing to the SSO oauth_manager.

Deprecated

  • None

Removed

  • None

Fixed

  • MCP OAuth sessions (e.g. provider='mcp:coda') being deleted from the database after every chat completion when the user is logged in via SSO, causing subsequent MCP tool calls to fail with 401 Unauthorized. (#24618)

Security

  • None

Breaking Changes

  • None

Additional Information

The fix follows the approach proposed by the issue reporter (verdier in #24618) and was independently verified against current dev by @Sean-Kenneth-Doherty, who also recommended the regression-test target adopted below. Another affected user (los93sol) confirmed the fix worked in their deployment before this PR was opened.

Design note: the session-selection logic was intentionally extracted into a separate oauth_session_utils.py module rather than kept as a private helper in middleware.py. This keeps the utility importable without pulling in the full middleware import chain, making it straightforward to unit-test and reuse.

Screenshots or Videos

  • None

Contributor License Agreement

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/24828 **Author:** [@IVVI0927](https://github.com/IVVI0927) **Created:** 5/17/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `fix/24618-mcp-oauth-session-wipe` --- ### 📝 Commits (3) - [`f1ff554`](https://github.com/open-webui/open-webui/commit/f1ff554f273769cb7309073fc2c78baa83bcb679) fix: skip MCP-provider sessions in SSO OAuth fallback (#24618) - [`e8f9476`](https://github.com/open-webui/open-webui/commit/e8f9476bbd6b6310b00e5ad21277c3283c573f45) test: add regression coverage for MCP session filtering in SSO fallback (#24618) - [`cfb9c72`](https://github.com/open-webui/open-webui/commit/cfb9c72467b2dee089094f37c7043d3c04c6ef33) refactor: extract select_sso_session to oauth_session_utils; update tests to use real function (#24618) ### 📊 Changes **5 files changed** (+140 additions, -2 deletions) <details> <summary>View changed files</summary> ➕ `backend/open_webui/test/__init__.py` (+0 -0) ➕ `backend/open_webui/test/utils/__init__.py` (+0 -0) ➕ `backend/open_webui/test/utils/test_get_system_oauth_token.py` (+117 -0) 📝 `backend/open_webui/utils/middleware.py` (+3 -2) ➕ `backend/open_webui/utils/oauth_session_utils.py` (+20 -0) </details> ### 📄 Description # Pull Request Checklist ### Note to first-time contributors: Please open a discussion post in [Discussions](https://github.com/open-webui/open-webui/discussions) to discuss your idea/fix with the community before creating a pull request, and describe your changes before submitting a pull request. This is to ensure large feature PRs are discussed with the community first, before starting work on it. If the community does not want this feature or it is not relevant for Open WebUI as a project, it can be identified in the discussion before working on the feature and submitting the PR. **Before submitting, make sure you've checked the following:** - [x] **Linked Issue/Discussion:** This PR references an existing [Issue](https://github.com/open-webui/open-webui/issues) or [Discussion](https://github.com/open-webui/open-webui/discussions) — `Closes #___` / `Relates to #___`. If one does not exist, create one first. PRs without a linked issue or discussion may be closed without review. - [x] **Target branch:** Verify that the pull request targets the `dev` branch. **PRs targeting `main` will be immediately closed.** - [x] **Description:** Provide a concise description of the changes made in this pull request down below. - [x] **Changelog:** Ensure a changelog entry following the format of [Keep a Changelog](https://keepachangelog.com/) is added at the bottom of the PR description. - [ ] **Documentation:** Add docs in [Open WebUI Docs Repository](https://github.com/open-webui/docs). Document user-facing behavior, environment variables, public APIs/interfaces, or deployment steps. - [x] **Dependencies:** Are there any new or upgraded dependencies? If so, explain why, update the changelog/docs, and include any compatibility notes. Actually run the code/function that uses updated library to ensure it doesn't crash. - [x] **Testing:** Perform manual tests to **verify the implemented fix/feature works as intended AND does not break any other functionality**. Include reproducible steps to demonstrate the issue before the fix. Test edge cases (URL encoding, HTML entities, types). Take this as an opportunity to **make screenshots of the feature/fix and include them in the PR description**. - [x] **Agentic AI Code:** Confirm this Pull Request is **not written by any AI Agent** or has at least **gone through additional human review AND manual testing**. If any AI Agent is the co-author of this PR, it may lead to immediate closure of the PR. - [x] **Code review:** Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards? - [x] **Design & Architecture:** Prefer smart defaults over adding new settings; use local state for ephemeral UI logic. Open a Discussion for major architectural or UX changes. - [x] **Git Hygiene:** Keep PRs atomic (one logical change). Clean up commits and rebase on `dev` to ensure no unrelated commits (e.g. from `main`) are included. Push updates to the existing PR branch instead of closing and reopening. - [x] **Title Prefix:** To clearly categorize this pull request, prefix the pull request title using one of the following: - **BREAKING CHANGE**: Significant changes that may affect compatibility - **build**: Changes that affect the build system or external dependencies - **ci**: Changes to our continuous integration processes or workflows - **chore**: Refactor, cleanup, or other non-functional code changes - **docs**: Documentation update or addition - **feat**: Introduces a new feature or enhancement to the codebase - **fix**: Bug fix or error correction - **i18n**: Internationalization or localization changes - **perf**: Performance improvement - **refactor**: Code restructuring for better maintainability, readability, or scalability - **style**: Changes that do not affect the meaning of the code (white space, formatting, missing semi-colons, etc.) - **test**: Adding missing tests or correcting existing tests - **WIP**: Work in progress, a temporary label for incomplete or ongoing work # Changelog Entry ### Description Fixes incorrect deletion of MCP OAuth sessions after every chat completion. The SSO OAuth token fallback in `get_system_oauth_token()` previously picked the most recent OAuth session of the user regardless of provider — including `mcp:*` sessions — and handed them to the SSO `oauth_manager`, which doesn't recognise MCP providers and deletes the session after a failed refresh. MCP sessions are now filtered out of this fallback path; their refresh is already handled separately by `oauth_client_manager.get_oauth_token()` in `process_chat_payload`. ### Added - `backend/open_webui/utils/oauth_session_utils.py` — lightweight module containing `select_sso_session()`, the helper that filters MCP sessions out of the SSO fallback path. - Regression test file `backend/open_webui/test/utils/test_get_system_oauth_token.py` with 6 cases covering the SSO/MCP session-filtering scenarios, exercising the real `select_sso_session()` function directly. ### Changed - Extracted session-selection logic into a new lightweight module `backend/open_webui/utils/oauth_session_utils.py` (`select_sso_session()`), keeping it importable without pulling in the full middleware chain. - `get_system_oauth_token()` in `backend/open_webui/utils/middleware.py` now delegates fallback session selection to `select_sso_session()`, which filters out `mcp:*` sessions before passing to the SSO `oauth_manager`. ### Deprecated - None ### Removed - None ### Fixed - MCP OAuth sessions (e.g. `provider='mcp:coda'`) being deleted from the database after every chat completion when the user is logged in via SSO, causing subsequent MCP tool calls to fail with `401 Unauthorized`. (#24618) ### Security - None ### Breaking Changes - None --- ### Additional Information The fix follows the approach proposed by the issue reporter (verdier in #24618) and was independently verified against current `dev` by @Sean-Kenneth-Doherty, who also recommended the regression-test target adopted below. Another affected user (los93sol) confirmed the fix worked in their deployment before this PR was opened. **Design note:** the session-selection logic was intentionally extracted into a separate `oauth_session_utils.py` module rather than kept as a private helper in `middleware.py`. This keeps the utility importable without pulling in the full middleware import chain, making it straightforward to unit-test and reuse. ### Screenshots or Videos - None ### Contributor License Agreement <!-- 🚨 DO NOT DELETE THE TEXT BELOW 🚨 Keep the "Contributor License Agreement" confirmation text intact. Deleting it will trigger the CLA-Bot to INVALIDATE your PR. Your PR will NOT be reviewed or merged until you check the box below confirming that you have read and agree to the terms of the CLA. --> - [x] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. > [!NOTE] > Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-05-18 16:08:26 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#115187