Bug Summary:
[Provide a brief but clear summary of the bug]
Users unable to log in via cloudflare sso
Steps to Reproduce:
[Outline the steps to reproduce the bug. Be as detailed as possible.]
Set WEBUI_AUTH_TRUSTED_EMAIL_HEADER to Cf-Access-Authenticated-User-Email and enable cloudflare access/tunnels
Expected Behavior:
[Describe what you expected to happen.]
Automatically log in the user
Actual Behavior:
[Describe what actually happened.]
Docker Container Logs:
[Include relevant Docker container logs, if applicable]
Screenshots (if applicable):
[Attach any relevant screenshots to help illustrate the issue]
Installation Method
[Describe the method you used to install the project, e.g., manual installation, Docker, package manager, etc.]
Additional Information
[Include any additional details that may help in understanding and reproducing the issue. This could include specific configurations, error messages, or anything else relevant to the bug.]
Note
If the bug report is incomplete or does not follow the provided instructions, it may not be addressed. Please ensure that you have followed the steps outlined in the README.md and troubleshooting.md documents, and provide all necessary information for us to reproduce and address the issue. Thank you!
Originally created by @ther3zz on GitHub (Jul 10, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/3757
# Bug Report
## Description
v0.3.8 breaks cloudflare sso.
**Bug Summary:**
[Provide a brief but clear summary of the bug]
Users unable to log in via cloudflare sso
**Steps to Reproduce:**
[Outline the steps to reproduce the bug. Be as detailed as possible.]
Set WEBUI_AUTH_TRUSTED_EMAIL_HEADER to Cf-Access-Authenticated-User-Email and enable cloudflare access/tunnels
**Expected Behavior:**
[Describe what you expected to happen.]
Automatically log in the user
**Actual Behavior:**
[Describe what actually happened.]
user unable to log in

## Environment
- **Open WebUI Version:** [e.g., 0.1.120] v0.3.8
- **Ollama (if applicable):** [e.g., 0.1.30, 0.1.32-rc1]
- **Operating System:** [e.g., Windows 10, macOS Big Sur, Ubuntu 20.04]
- **Browser (if applicable):** [e.g., Chrome 100.0, Firefox 98.0]
## Reproduction Details
**Confirmation:**
- [x] I have read and followed all the instructions provided in the README.md.
- [x] I am on the latest version of both Open WebUI and Ollama.
- [x] I have included the browser console logs.
- [ ] I have included the Docker container logs.
## Logs and Screenshots
**Browser Console Logs:**
[Include relevant browser console logs, if applicable]
[openwebui logs.txt](https://github.com/user-attachments/files/16160338/openwebui.logs.txt)
**Docker Container Logs:**
[Include relevant Docker container logs, if applicable]
**Screenshots (if applicable):**
[Attach any relevant screenshots to help illustrate the issue]
## Installation Method
[Describe the method you used to install the project, e.g., manual installation, Docker, package manager, etc.]
## Additional Information
[Include any additional details that may help in understanding and reproducing the issue. This could include specific configurations, error messages, or anything else relevant to the bug.]
## Note
If the bug report is incomplete or does not follow the provided instructions, it may not be addressed. Please ensure that you have followed the steps outlined in the README.md and troubleshooting.md documents, and provide all necessary information for us to reproduce and address the issue. Thank you!
I'm having the same issue after upgrading to 0.3.8 with Tailscale Serve auth. So maybe it's a wider issue with WEBUI_AUTH_TRUSTED_EMAIL_HEADER and the fact that it uses passwordless login. 0.3.7 still works fine.
<!-- gh-comment-id:2220908710 -->
@josh commented on GitHub (Jul 10, 2024):
I'm having the same issue after upgrading to 0.3.8 with [Tailscale Serve](https://docs.openwebui.com/tutorial/sso#tailscale-serve) auth. So maybe it's a wider issue with `WEBUI_AUTH_TRUSTED_EMAIL_HEADER` and the fact that it uses passwordless login. 0.3.7 still works fine.
Same issue with Authentik + Traefik and forwarded headers. Version 3.7 works, 3.8 is broken.
<!-- gh-comment-id:2220998957 -->
@tedstriker commented on GitHub (Jul 10, 2024):
Same issue with Authentik + Traefik and forwarded headers. Version 3.7 works, 3.8 is broken.
So docker logs don't even show anything for me in regards to cloudflare SSO using that WEBUI_AUTH_TRUSTED_EMAIL_HEADER param (after trying to log in).
I even set GLOBAL_LOG_LEVEL to DEBUG and still nothing useful came up there.
INFO: Started server process [1]
INFO: Waiting for application startup.
___ __ __ _ _ _ ___
/ _ \ _ __ ___ _ __ \ \ / /__| |__ | | | |_ _|
| | | | '_ \ / _ \ '_ \ \ \ /\ / / _ \ '_ \| | | || |
| |_| | |_) | __/ | | | \ V V / __/ |_) | |_| || |
\___/| .__/ \___|_| |_| \_/\_/ \___|_.__/ \___/|___|
|_|
v0.3.8 - building the best open-source AI user interface.
https://github.com/open-webui/open-webui
INFO [alembic.runtime.migration] Context impl SQLiteImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
<!-- gh-comment-id:2221358813 -->
@ther3zz commented on GitHub (Jul 10, 2024):
> Relevant logs would be tremendously helpful here.
So docker logs don't even show anything for me in regards to cloudflare SSO using that WEBUI_AUTH_TRUSTED_EMAIL_HEADER param (after trying to log in).
I even set GLOBAL_LOG_LEVEL to DEBUG and still nothing useful came up there.
```
INFO: Started server process [1]
INFO: Waiting for application startup.
___ __ __ _ _ _ ___
/ _ \ _ __ ___ _ __ \ \ / /__| |__ | | | |_ _|
| | | | '_ \ / _ \ '_ \ \ \ /\ / / _ \ '_ \| | | || |
| |_| | |_) | __/ | | | \ V V / __/ |_) | |_| || |
\___/| .__/ \___|_| |_| \_/\_/ \___|_.__/ \___/|___|
|_|
v0.3.8 - building the best open-source AI user interface.
https://github.com/open-webui/open-webui
INFO [alembic.runtime.migration] Context impl SQLiteImpl.
INFO [alembic.runtime.migration] Will assume non-transactional DDL.
```
Same goes for the Authentik variant.
I'd be happy to provide some. Do you know where to find them @tjbck?
<!-- gh-comment-id:2221395392 -->
@tedstriker commented on GitHub (Jul 10, 2024):
Same goes for the Authentik variant.
I'd be happy to provide some. Do you know where to find them @tjbck?
<!-- gh-comment-id:2221400400 -->
@tjbck commented on GitHub (Jul 10, 2024):
Just pushed a fix to main https://github.com/open-webui/open-webui/pull/3773
Let us know if that fixed the issue!
<!-- gh-comment-id:2221417529 -->
@ther3zz commented on GitHub (Jul 10, 2024):
> Just pushed a fix to main #3773
>
> Let us know if that fixed the issue!
Issue is still persisting for me on v0.3.8 :(
Could you verify you're on the latest main, and not just 0.3.8?
Correct, I'm using the following repo:
ghcr.io/open-webui/open-webui:latest
<!-- gh-comment-id:2221423941 -->
@ther3zz commented on GitHub (Jul 10, 2024):
> Could you verify you're on the latest main, and not just 0.3.8?
Correct, I'm using the following repo:
ghcr.io/open-webui/open-webui:latest
Seems like the image build process has failed for some reason, I'll let you know when the newer build gets pushed!
<!-- gh-comment-id:2221430387 -->
@tjbck commented on GitHub (Jul 10, 2024):
Seems like the image build process has failed for some reason, I'll let you know when the newer build gets pushed!
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @ther3zz on GitHub (Jul 10, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/3757
Bug Report
Description
v0.3.8 breaks cloudflare sso.
Bug Summary:
[Provide a brief but clear summary of the bug]
Users unable to log in via cloudflare sso
Steps to Reproduce:
[Outline the steps to reproduce the bug. Be as detailed as possible.]
Set WEBUI_AUTH_TRUSTED_EMAIL_HEADER to Cf-Access-Authenticated-User-Email and enable cloudflare access/tunnels
Expected Behavior:
[Describe what you expected to happen.]
Automatically log in the user
Actual Behavior:
[Describe what actually happened.]
user unable to log in

Environment
Open WebUI Version: [e.g., 0.1.120] v0.3.8
Ollama (if applicable): [e.g., 0.1.30, 0.1.32-rc1]
Operating System: [e.g., Windows 10, macOS Big Sur, Ubuntu 20.04]
Browser (if applicable): [e.g., Chrome 100.0, Firefox 98.0]
Reproduction Details
Confirmation:
Logs and Screenshots
Browser Console Logs:
[Include relevant browser console logs, if applicable]
openwebui logs.txt
Docker Container Logs:
[Include relevant Docker container logs, if applicable]
Screenshots (if applicable):
[Attach any relevant screenshots to help illustrate the issue]
Installation Method
[Describe the method you used to install the project, e.g., manual installation, Docker, package manager, etc.]
Additional Information
[Include any additional details that may help in understanding and reproducing the issue. This could include specific configurations, error messages, or anything else relevant to the bug.]
Note
If the bug report is incomplete or does not follow the provided instructions, it may not be addressed. Please ensure that you have followed the steps outlined in the README.md and troubleshooting.md documents, and provide all necessary information for us to reproduce and address the issue. Thank you!
@josh commented on GitHub (Jul 10, 2024):
I'm having the same issue after upgrading to 0.3.8 with Tailscale Serve auth. So maybe it's a wider issue with
WEBUI_AUTH_TRUSTED_EMAIL_HEADERand the fact that it uses passwordless login. 0.3.7 still works fine.@tedstriker commented on GitHub (Jul 10, 2024):
Same issue with Authentik + Traefik and forwarded headers. Version 3.7 works, 3.8 is broken.
@tjbck commented on GitHub (Jul 10, 2024):
Relevant logs would be tremendously helpful here.
@ther3zz commented on GitHub (Jul 10, 2024):
So docker logs don't even show anything for me in regards to cloudflare SSO using that WEBUI_AUTH_TRUSTED_EMAIL_HEADER param (after trying to log in).
I even set GLOBAL_LOG_LEVEL to DEBUG and still nothing useful came up there.
@tedstriker commented on GitHub (Jul 10, 2024):
Same goes for the Authentik variant.
I'd be happy to provide some. Do you know where to find them @tjbck?
@tjbck commented on GitHub (Jul 10, 2024):
Just pushed a fix to main https://github.com/open-webui/open-webui/pull/3773
Let us know if that fixed the issue!
@ther3zz commented on GitHub (Jul 10, 2024):
Issue is still persisting for me on v0.3.8 :(
@tjbck commented on GitHub (Jul 10, 2024):
Could you verify you're on the latest main, and not just 0.3.8?
@ther3zz commented on GitHub (Jul 10, 2024):
Correct, I'm using the following repo:
ghcr.io/open-webui/open-webui:latest
@ther3zz commented on GitHub (Jul 10, 2024):
Here is full docker log:
@tjbck commented on GitHub (Jul 10, 2024):
Seems like the image build process has failed for some reason, I'll let you know when the newer build gets pushed!
@tjbck commented on GitHub (Jul 10, 2024):
@ther3zz latest image should be available now!
@ther3zz commented on GitHub (Jul 10, 2024):
its fixed, thank you!