[GH-ISSUE #8074] infra: Network Problem 0.5+ #118297

Closed
opened 2026-05-20 19:41:19 -05:00 by GiteaMirror · 201 comments
Owner

Originally created by @Simi5599 on GitHub (Dec 25, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/8074

https://github.com/open-webui/open-webui/releases/tag/v0.5.0

image

Bug Report

Installation Method

Docker

Environment

  • Open WebUI Version: 0.5.0

  • Operating System: Windows 11

  • Browser (if applicable): Firefox 133.0.3

Confirmation:

  • I have read and followed all the instructions provided in the README.md.
  • I am on the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below.

Expected Behavior:

When asking something to the LMM it should answer normally

Actual Behavior:

The LMM gives an error "Network Problem".

Reproduction Details

Steps to Reproduce:

  1. Simply ask the LMM something (i am using the OpenAI APIs)

Logs and Screenshots

Browser Console Logs:
`submitPrompt Hello!!!! Chat.svelte:1168:10
destroy MessageInput.svelte:331:10
RichTextInput.svelte:129:10
saveSessionSelectedModels
Array [ "gpt-4o-mini-2024-07-18" ]
["gpt-4o-mini-2024-07-18"] Chat.svelte:176:10
[tiptap warn]: Duplicate extension names found: ['codeBlock']. This can lead to issues. index.js:1158:20
modelId gpt-4o-mini-2024-07-18 Chat.svelte:1338:12
GET
wss://myurl.it/ws/socket.io/?EIO=4&transport=websocket
NS_ERROR_WEBSOCKET_CONNECTION_REFUSED

Firefox non può stabilire una connessione con il server wss://myurl.it/ws/socket.io/?EIO=4&transport=websocket. websocket.js:43:26
connect_error Error: websocket error
xe transport.js:7
onError transport.js:38
onerror websocket.js:69
addEventListeners websocket.js:69
doOpen websocket.js:50
open transport.js:46
open socket.js:170
b socket.js:111
open manager.js:108
n manager.js:328
setTimeout handlerreconnect manager.js:321
n manager.js:331
r manager.js:123
h manager.js:137
setTimeout handler
open manager.js:135
n manager.js:328
setTimeout handlerreconnect manager.js:321
n manager.js:331
r manager.js:123
h manager.js:137
setTimeout handler
open manager.js:135
n manager.js:328
setTimeout handler*reconnect manager.js:321
n manager.js:331
r manager.js:123
emit index.js:136
onError socket.js:541
emit index.js:136
onError transport.js:38
onerror websocket.js:69
addEventListeners websocket.js:69
doOpen websocket.js:50
open transport.js:46
open socket.js:170
b socket.js:111
open manager.js:108
n manager.js:328
+layout.svelte:62:11
Network Problem Chat.svelte:1527:11
null Chat.svelte:1536:10`

Docker Container Logs:
ERROR [asyncio] Unclosed client session client_session: <aiohttp.client.ClientSession object at 0x7fa5fc8d9a90> ERROR [asyncio] Unclosed connector connections: ['deque([(<aiohttp.client_proto.ResponseHandler object at 0x7fa5f43038c0>, 365892.936776659)])'] connector: <aiohttp.connector.TCPConnector object at 0x7fa5f7669650>

Screenshots/Screen Recordings (if applicable):
Screenshot 2024-12-25 233911

Image

Originally created by @Simi5599 on GitHub (Dec 25, 2024). Original GitHub issue: https://github.com/open-webui/open-webui/issues/8074 https://github.com/open-webui/open-webui/releases/tag/v0.5.0 ![image](https://github.com/user-attachments/assets/756a876a-4bd3-4d94-9f77-383e6c9f2b99) # Bug Report ## Installation Method Docker ## Environment - **Open WebUI Version:** 0.5.0 - **Operating System:** Windows 11 - **Browser (if applicable):** Firefox 133.0.3 **Confirmation:** - [x] I have read and followed all the instructions provided in the README.md. - [x] I am on the latest version of both Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below. ## Expected Behavior: When asking something to the LMM it should answer normally ## Actual Behavior: The LMM gives an error "Network Problem". ## Reproduction Details **Steps to Reproduce:** 1. Simply ask the LMM something (i am using the OpenAI APIs) ## Logs and Screenshots **Browser Console Logs:** `submitPrompt Hello!!!! <empty string> [Chat.svelte:1168:10](https:/myurl.szsolutions.it/src/lib/components/chat/Chat.svelte) destroy [MessageInput.svelte:331:10](https://myurl.it/src/lib/components/chat/MessageInput.svelte) <empty string> [RichTextInput.svelte:129:10](https://myurl.it/src/lib/components/common/RichTextInput.svelte) saveSessionSelectedModels Array [ "gpt-4o-mini-2024-07-18" ] ["gpt-4o-mini-2024-07-18"] [Chat.svelte:176:10](https://myurl.it/src/lib/components/chat/Chat.svelte) [tiptap warn]: Duplicate extension names found: ['codeBlock']. This can lead to issues. [index.js:1158:20](https://myurl.it/node_modules/@tiptap/core/dist/index.js) modelId gpt-4o-mini-2024-07-18 [Chat.svelte:1338:12](https://myurl.it/src/lib/components/chat/Chat.svelte) GET wss://myurl.it/ws/socket.io/?EIO=4&transport=websocket NS_ERROR_WEBSOCKET_CONNECTION_REFUSED Firefox non può stabilire una connessione con il server wss://myurl.it/ws/socket.io/?EIO=4&transport=websocket. [websocket.js:43:26](https://myurl.it/node_modules/engine.io-client/build/esm/transports/websocket.js) connect_error Error: websocket error xe transport.js:7 onError transport.js:38 onerror websocket.js:69 addEventListeners websocket.js:69 doOpen websocket.js:50 open transport.js:46 open socket.js:170 b socket.js:111 open manager.js:108 n manager.js:328 setTimeout handler*reconnect manager.js:321 n manager.js:331 r manager.js:123 h manager.js:137 setTimeout handler*open manager.js:135 n manager.js:328 setTimeout handler*reconnect manager.js:321 n manager.js:331 r manager.js:123 h manager.js:137 setTimeout handler*open manager.js:135 n manager.js:328 setTimeout handler*reconnect manager.js:321 n manager.js:331 r manager.js:123 emit index.js:136 onError socket.js:541 emit index.js:136 onError transport.js:38 onerror websocket.js:69 addEventListeners websocket.js:69 doOpen websocket.js:50 open transport.js:46 open socket.js:170 b socket.js:111 open manager.js:108 n manager.js:328 [+layout.svelte:62:11](https://myurl.it/src/routes/+layout.svelte) Network Problem [Chat.svelte:1527:11](https://myurl.it/src/lib/components/chat/Chat.svelte) null [Chat.svelte:1536:10](https://myurl.it/src/lib/components/chat/Chat.svelte)` **Docker Container Logs:** `ERROR [asyncio] Unclosed client session client_session: <aiohttp.client.ClientSession object at 0x7fa5fc8d9a90> ERROR [asyncio] Unclosed connector connections: ['deque([(<aiohttp.client_proto.ResponseHandler object at 0x7fa5f43038c0>, 365892.936776659)])'] connector: <aiohttp.connector.TCPConnector object at 0x7fa5f7669650>` **Screenshots/Screen Recordings (if applicable):** ![Screenshot 2024-12-25 233911](https://github.com/user-attachments/assets/9a6d918d-983e-4f3d-82fe-710ed2cd7d33) ![Image](https://github.com/user-attachments/assets/df5ea951-c735-4372-8efa-7e03cd0e0184)
Author
Owner

@tjbck commented on GitHub (Dec 25, 2024):

Related: https://github.com/open-webui/open-webui/discussions/8073

As mentioned in the changelogs, you need a proper websocket support going forward with 0.5.0+

I'll make a educated guess here and say you have a network misconfiguration (most likely your reverse proxy) that's blocking the webui from properly communicating with the backend. You'll notice without the reverse proxy, the webui will work as intended (let me know if this is not the case for you). The recommended course of action would be to ask questions directly in the respective reverse proxy community.

Keep us updated with your troubleshooting journey!

Update

If you directly access the webui via localhost, you should not encounter this issue.

<!-- gh-comment-id:2562015764 --> @tjbck commented on GitHub (Dec 25, 2024): Related: https://github.com/open-webui/open-webui/discussions/8073 As mentioned in the changelogs, you need a proper websocket support going forward with 0.5.0+ I'll make a educated guess here and say you have a network misconfiguration (most likely your reverse proxy) that's blocking the webui from properly communicating with the backend. You'll notice **without the reverse proxy,** the webui **will work** as intended (let me know if this is not the case for you). The recommended course of action would be to ask questions directly in the respective reverse proxy community. Keep us updated with your troubleshooting journey! # Update If you directly access the webui via localhost, you should not encounter this issue.
Author
Owner

@Blygf commented on GitHub (Dec 25, 2024):

I had the same problem and after about an hour of trying to fix it i just reverted to v0.4.8.

<!-- gh-comment-id:2562016459 --> @Blygf commented on GitHub (Dec 25, 2024): I had the same problem and after about an hour of trying to fix it i just reverted to v0.4.8.
Author
Owner

@Simi5599 commented on GitHub (Dec 25, 2024):

Thanks to @tjbck for your hint; I was able to fix this.
Basically, I am using Apache on my server as a proxy to my Docker container, and I had the following lines:

ProxyPass / http://127.0.0.1:5598/
ProxyPassReverse / http://127.0.0.1:5598/

I simply changed them to:

ProxyPass / http://127.0.0.1:5598/
ProxyPassReverse / http://127.0.0.1:5598/
<Location />       
    ProxyPass ws://localhost:5598/
    ProxyPassReverse ws://localhost:5598/
</Location>

PROOF:
Screenshot 2024-12-25 235127

For now everything is working fine!

<!-- gh-comment-id:2562017399 --> @Simi5599 commented on GitHub (Dec 25, 2024): Thanks to @tjbck for your hint; I was able to fix this. Basically, I am using Apache on my server as a proxy to my Docker container, and I had the following lines: ``` ProxyPass / http://127.0.0.1:5598/ ProxyPassReverse / http://127.0.0.1:5598/ ``` I simply changed them to: ``` ProxyPass / http://127.0.0.1:5598/ ProxyPassReverse / http://127.0.0.1:5598/ <Location /> ProxyPass ws://localhost:5598/ ProxyPassReverse ws://localhost:5598/ </Location> ``` PROOF: ![Screenshot 2024-12-25 235127](https://github.com/user-attachments/assets/f4a3b15e-b24e-44a6-941b-742aefd5bc22) For now everything is working fine!
Author
Owner

@ArakiSatoshi commented on GitHub (Dec 25, 2024):

I'm experiencing the same issue after upgrading to 0.5.0.

In the console, I keep seeing these INFO warnings popping up every second:

INFO:     127.0.0.1:38708 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01YYc HTTP/1.1" 400 Bad Request
INFO:     127.0.0.1:38720 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01Yo8 HTTP/1.1" 400 Bad Request
INFO:     127.0.0.1:38728 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01Z1w HTTP/1.1" 400 Bad Request

I can send messages to chatbots and receive responses, however, there's an 'session_id' error underneath every new bot's message.

If relevant, my nginx config looks like this:

server {
    listen 443 ssl;
    server_name openwebui.example.com;
    ssl_certificate /etc/letsencrypt/live/openwebui.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/openwebui.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8081;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

And my open-webui is deployed via the pip method.

<!-- gh-comment-id:2562017525 --> @ArakiSatoshi commented on GitHub (Dec 25, 2024): I'm experiencing the same issue after upgrading to 0.5.0. In the console, I keep seeing these INFO warnings popping up every second: ``` INFO: 127.0.0.1:38708 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01YYc HTTP/1.1" 400 Bad Request INFO: 127.0.0.1:38720 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01Yo8 HTTP/1.1" 400 Bad Request INFO: 127.0.0.1:38728 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01Z1w HTTP/1.1" 400 Bad Request ``` I can send messages to chatbots and receive responses, however, there's an `'session_id'` error underneath every new bot's message. If relevant, my nginx config looks like this: ``` server { listen 443 ssl; server_name openwebui.example.com; ssl_certificate /etc/letsencrypt/live/openwebui.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/openwebui.example.com/privkey.pem; location / { proxy_pass http://127.0.0.1:8081; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_set_header Host $host; proxy_cache_bypass $http_upgrade; } } ``` And my open-webui is deployed via the pip method.
Author
Owner

@tjbck commented on GitHub (Dec 25, 2024):

@Simi5599 Thanks for the update, let's keep this issue open for other users to find your solution!

<!-- gh-comment-id:2562017596 --> @tjbck commented on GitHub (Dec 25, 2024): @Simi5599 Thanks for the update, let's keep this issue open for other users to find your solution!
Author
Owner

@Simi5599 commented on GitHub (Dec 25, 2024):

proxy_pass http://127.0.0.1:8081;

Try to add another line with ws://127.0.0.1:8081

<!-- gh-comment-id:2562017791 --> @Simi5599 commented on GitHub (Dec 25, 2024): > proxy_pass http://127.0.0.1:8081; Try to add another line with ws://127.0.0.1:8081
Author
Owner

@Simi5599 commented on GitHub (Dec 25, 2024):

@tjbck don't know if this is related but title generation is not working anymore. Should i open a new issue?

<!-- gh-comment-id:2562018780 --> @Simi5599 commented on GitHub (Dec 25, 2024): @tjbck don't know if this is related but title generation is not working anymore. Should i open a new issue?
Author
Owner

@tjbck commented on GitHub (Dec 25, 2024):

@Simi5599 Unable to reproduce on my end, but yes feel free to open a new issue post with relevant backend/browser logs!

<!-- gh-comment-id:2562019007 --> @tjbck commented on GitHub (Dec 25, 2024): @Simi5599 Unable to reproduce on my end, but yes feel free to open a new issue post with relevant backend/browser logs!
Author
Owner

@ArakiSatoshi commented on GitHub (Dec 25, 2024):

proxy_pass http://127.0.0.1:8081;

Try to add another line with ws://127.0.0.1:8081

Nginx considers another proxy_pass line as a duplicate, as far as I know it should handle ws:// traffic by default as long as you already have an http:// proxy_pass.

I attempted making a more excessive nginx configuration:

server {
    listen              443 ssl http2;
    listen              [::]:443 ssl http2;
    server_name         openwebui.example.com;

    # SSL
    ssl_certificate     /etc/letsencrypt/live/openwebui.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/openwebui.example.com/privkey.pem;

    # security
    add_header X-XSS-Protection          "1; mode=block" always;
    add_header X-Content-Type-Options    "nosniff" always;
    add_header Referrer-Policy           "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy   "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
    add_header Permissions-Policy        "interest-cohort=()" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # . files
    location ~ /\.(?!well-known) {
        deny all;
    }

    # reverse proxy
    location / {
        proxy_pass            http://127.0.0.1:8081;
        proxy_set_header Host $host;

        proxy_http_version                 1.1;
        proxy_cache_bypass                 $http_upgrade;

        # Proxy SSL
        proxy_ssl_server_name              on;

        # Proxy headers
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        $connection_upgrade;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host  $host;
        proxy_set_header X-Forwarded-Port  $server_port;

        # Proxy timeouts
        proxy_connect_timeout              60s;
        proxy_send_timeout                 60s;
        proxy_read_timeout                 60s;
    }

}

The app seems to function correctly now, the titles do generate as well. However, I'm still getting the INFO messages in the console, suggesting that something is probably still not functioning correctly:

INFO:     xxx.xxx.xxx.xxx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG08v05 HTTP/1.1" 400 Bad Request
INFO:     xxx.xxx.xxx.xxx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG08vVE HTTP/1.1" 400 Bad Request
INFO:     xxx.xxx.xxx.xxx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG08vVE HTTP/1.1" 400 Bad Request

This time it's my client's IP instead of 127.0.0.1.

I don't have enough knowledge about networking to troubleshoot it further.

Edit: It appears that my older tabs were stuck in some kind of a loop sending requests to the server, after closing them and opening a fresh tab with open-webui I no longer see the INFO messages. The issue is resolved for me now, but maybe the project needs official nginx/apache/traefik/caddy configurations for people who use open-webui on a remote system.

<!-- gh-comment-id:2562023003 --> @ArakiSatoshi commented on GitHub (Dec 25, 2024): > > proxy_pass http://127.0.0.1:8081; > > Try to add another line with ws://127.0.0.1:8081 Nginx considers another `proxy_pass` line as a duplicate, as far as I know it should handle `ws://` traffic by default as long as you already have an `http://` `proxy_pass`. I attempted making a more [excessive nginx configuration](https://github.com/digitalocean/nginxconfig.io): ``` server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name openwebui.example.com; # SSL ssl_certificate /etc/letsencrypt/live/openwebui.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/openwebui.example.com/privkey.pem; # security add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "no-referrer-when-downgrade" always; add_header Content-Security-Policy "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always; add_header Permissions-Policy "interest-cohort=()" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; # . files location ~ /\.(?!well-known) { deny all; } # reverse proxy location / { proxy_pass http://127.0.0.1:8081; proxy_set_header Host $host; proxy_http_version 1.1; proxy_cache_bypass $http_upgrade; # Proxy SSL proxy_ssl_server_name on; # Proxy headers proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Port $server_port; # Proxy timeouts proxy_connect_timeout 60s; proxy_send_timeout 60s; proxy_read_timeout 60s; } } ``` The app seems to function correctly now, the titles do generate as well. However, I'm still getting the INFO messages in the console, suggesting that *something* is probably still not functioning correctly: ``` INFO: xxx.xxx.xxx.xxx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG08v05 HTTP/1.1" 400 Bad Request INFO: xxx.xxx.xxx.xxx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG08vVE HTTP/1.1" 400 Bad Request INFO: xxx.xxx.xxx.xxx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG08vVE HTTP/1.1" 400 Bad Request ``` This time it's my client's IP instead of 127.0.0.1. I don't have enough knowledge about networking to troubleshoot it further. **Edit:** It appears that my older tabs were stuck in some kind of a loop sending requests to the server, after closing them and opening a fresh tab with open-webui I no longer see the INFO messages. The issue is resolved for me now, but maybe the project needs official nginx/apache/traefik/caddy configurations for people who use open-webui on a remote system.
Author
Owner

@Simi5599 commented on GitHub (Dec 26, 2024):

the titles do generate as well

In my case, the titles weren't auto-generating due to an issue with the OpenAI API requests, so this was not related. #8075

<!-- gh-comment-id:2562037612 --> @Simi5599 commented on GitHub (Dec 26, 2024): > the titles do generate as well In my case, the titles weren't auto-generating due to an issue with the OpenAI API requests, so this was not related. #8075
Author
Owner

@PhilosophiMoonbeam commented on GitHub (Dec 26, 2024):

Issue: WebSocket Connections Failing Through Nginx Reverse Proxy


Problem

When using Nginx as a reverse proxy for a Dockerized app (exposed on localhost:3000), WebSocket connections fail. This is due to incorrect or missing headers in Nginx’s configuration, which are required to handle WebSocket protocol upgrades (Connection and Upgrade headers).


Solution: Update Nginx Configuration for WebSocket Support

Core Changes:

Modify your Nginx HTTPS (443) server block to include WebSocket-specific headers. Here's the updated configuration:

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location / {
        proxy_pass http://localhost:3000;  # Forward to Docker app

        # Add WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Standard headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Timeouts for WebSocket connections
        proxy_read_timeout 60s;
        proxy_send_timeout 60s;
    }
}

Optional: Add an HTTP (80) server block to redirect traffic to HTTPS:

server {
    listen 80;
    server_name example.com;

    return 301 https://$host$request_uri;

    # Allow Certbot ACME challenges for SSL renewal
    location ~ /.well-known/acme-challenge { allow all; }
}

Steps to Fix

  1. Edit the Nginx Configuration:
    Update your Nginx file, typically located in /etc/nginx/sites-available/<your-config>.

  2. Test the Changes:
    Validate configuration syntax:

    sudo nginx -t
    
  3. Reload Nginx:
    Apply the updated configuration:

    sudo systemctl reload nginx
    
  4. Validate WebSocket Connections:

    • Open your app and inspect the WebSocket handshake in browser developer tools (F12 → Network → WS).
    • Alternatively, use curl to test WebSocket headers:
      curl -i -N -H "Connection: Upgrade" -H "Upgrade: websocket" https://example.com
      

Results

This configuration enables Nginx to properly handle WebSocket traffic by passing upgrade headers between the frontend and backend while maintaining SSL encryption. If issues persist, verify Docker container binding (0.0.0.0:3000), network accessibility, or check Nginx logs:

sudo tail -f /var/log/nginx/error.log
<!-- gh-comment-id:2562061337 --> @PhilosophiMoonbeam commented on GitHub (Dec 26, 2024): # Issue: WebSocket Connections Failing Through Nginx Reverse Proxy --- ## **Problem** When using Nginx as a reverse proxy for a Dockerized app (exposed on `localhost:3000`), WebSocket connections fail. This is due to incorrect or missing headers in Nginx’s configuration, which are required to handle WebSocket protocol upgrades (`Connection` and `Upgrade` headers). --- ## **Solution: Update Nginx Configuration for WebSocket Support** ### Core Changes: Modify your Nginx **HTTPS (`443`) server block** to include WebSocket-specific headers. Here's the updated configuration: ```nginx server { listen 443 ssl; server_name example.com; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; location / { proxy_pass http://localhost:3000; # Forward to Docker app # Add WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; # Standard headers proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # Timeouts for WebSocket connections proxy_read_timeout 60s; proxy_send_timeout 60s; } } ``` Optional: Add an HTTP (`80`) server block to redirect traffic to HTTPS: ```nginx server { listen 80; server_name example.com; return 301 https://$host$request_uri; # Allow Certbot ACME challenges for SSL renewal location ~ /.well-known/acme-challenge { allow all; } } ``` --- ## **Steps to Fix** 1. **Edit the Nginx Configuration**: Update your Nginx file, typically located in `/etc/nginx/sites-available/<your-config>`. 2. **Test the Changes**: Validate configuration syntax: ```bash sudo nginx -t ``` 3. **Reload Nginx**: Apply the updated configuration: ```bash sudo systemctl reload nginx ``` 4. **Validate WebSocket Connections**: - Open your app and inspect the WebSocket handshake in browser developer tools (`F12` → Network → WS). - Alternatively, use `curl` to test WebSocket headers: ```bash curl -i -N -H "Connection: Upgrade" -H "Upgrade: websocket" https://example.com ``` --- ## **Results** This configuration enables Nginx to properly handle WebSocket traffic by passing upgrade headers between the frontend and backend while maintaining SSL encryption. If issues persist, verify Docker container binding (`0.0.0.0:3000`), network accessibility, or check Nginx logs: ```bash sudo tail -f /var/log/nginx/error.log ```
Author
Owner

@guangzhaoli commented on GitHub (Dec 26, 2024):

For

INFO: 127.0.0.1:38708 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01YYc HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:38720 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01Yo8 HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:38728 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01Z1w HTTP/1.1" 400 Bad Request

This problem is obviously that your nginx reverse proxy has not added the websocket configuration and correctly handles the handshake and data transmission of the WebSocket protocol.

You just need to add in nginx configuration:

location / {

......

WebSocket

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}

<!-- gh-comment-id:2562156476 --> @guangzhaoli commented on GitHub (Dec 26, 2024): For > INFO: 127.0.0.1:38708 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01YYc HTTP/1.1" 400 Bad Request > INFO: 127.0.0.1:38720 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01Yo8 HTTP/1.1" 400 Bad Request > INFO: 127.0.0.1:38728 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01Z1w HTTP/1.1" 400 Bad Request This problem is obviously that your nginx reverse proxy has not added the websocket configuration and correctly handles the handshake and data transmission of the WebSocket protocol. You just need to add in nginx configuration: location / { ...... # WebSocket proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; }
Author
Owner

@ccinoo commented on GitHub (Dec 26, 2024):

For-----------谷歌翻译-----------为了

INFO: 127.0.0.1:38708 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01YYc HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:38720 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01Yo8 HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:38728 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01Z1w HTTP/1.1" 400 Bad Request

This problem is obviously that your nginx reverse proxy has not added the websocket configuration and correctly handles the handshake and data transmission of the WebSocket protocol.-----------谷歌翻译-----------这个问题显然是你的nginx反向代理没有添加websocket配置并正确处理WebSocket协议的握手和数据传输。

You just need to add in nginx configuration:-----------谷歌翻译-----------您只需要在 nginx 配置中添加:

location / {-----------谷歌翻译-----------地点 / {

......-----------谷歌翻译-----------......

WebSocket

proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; }-----------谷歌翻译-----------proxy_set_header 升级 $http_upgrade;proxy_set_header 连接“升级”;}

Great, this method works.

<!-- gh-comment-id:2562205372 --> @ccinoo commented on GitHub (Dec 26, 2024): > For-----------谷歌翻译-----------为了 > > > INFO: 127.0.0.1:38708 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01YYc HTTP/1.1" 400 Bad Request > > INFO: 127.0.0.1:38720 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01Yo8 HTTP/1.1" 400 Bad Request > > INFO: 127.0.0.1:38728 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG01Z1w HTTP/1.1" 400 Bad Request > > This problem is obviously that your nginx reverse proxy has not added the websocket configuration and correctly handles the handshake and data transmission of the WebSocket protocol.-----------谷歌翻译-----------这个问题显然是你的nginx反向代理没有添加websocket配置并正确处理WebSocket协议的握手和数据传输。 > > You just need to add in nginx configuration:-----------谷歌翻译-----------您只需要在 nginx 配置中添加: > > location / {-----------谷歌翻译-----------地点 / { > > ......-----------谷歌翻译-----------...... > > # WebSocket > proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; }-----------谷歌翻译-----------proxy_set_header 升级 $http_upgrade;proxy_set_header 连接“升级”;} Great, this method works.
Author
Owner

@chrismahoney commented on GitHub (Dec 26, 2024):

On a related note, this same issue arises while utilizing CloudFlare tunnels and there doesn't seem to be a clear fix for that compared to these adjustments to nginx for allowing websockets. I'll create a new issue for that, but in case anyone has some tips there that would be awesome.

<!-- gh-comment-id:2562207854 --> @chrismahoney commented on GitHub (Dec 26, 2024): On a related note, this same issue arises while utilizing CloudFlare tunnels and there doesn't seem to be a clear fix for that compared to these adjustments to nginx for allowing websockets. I'll create a new issue for that, but in case anyone has some tips there that would be awesome.
Author
Owner

@chenm1xuexi commented on GitHub (Dec 26, 2024):

I deployed the latest version 0.5.1 using docker, and the ng configuration supports web socket, but the system log prompt is
INFO: xx.xx.xx.xx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG23yFx HTTP/1.1" 400 Bad Request
When I roll back to version 0.4.8,
the log is:
INFO: xx.xx.xx.xx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG24X9C&sid=ncdWl4JHRt0k4D4zAAAC HTTP/1.1" 200 OK
A new sid field has been added. I don't know if the official lack of this field caused the current problem. Please explain

<!-- gh-comment-id:2562309633 --> @chenm1xuexi commented on GitHub (Dec 26, 2024): I deployed the latest version 0.5.1 using docker, and the ng configuration supports web socket, but the system log prompt is INFO: xx.xx.xx.xx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG23yFx HTTP/1.1" 400 Bad Request When I roll back to version 0.4.8, the log is: INFO: xx.xx.xx.xx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG24X9C&sid=ncdWl4JHRt0k4D4zAAAC HTTP/1.1" 200 OK A new sid field has been added. I don't know if the official lack of this field caused the current problem. Please explain
Author
Owner

@luzhao2 commented on GitHub (Dec 26, 2024):

I deployed version 0.5.1 using Docker and also configured Nginx to support WebSocket, but it still doesn’t work. The logs are the same as above.

<!-- gh-comment-id:2562316033 --> @luzhao2 commented on GitHub (Dec 26, 2024): I deployed version 0.5.1 using Docker and also configured Nginx to support WebSocket, but it still doesn’t work. The logs are the same as above.
Author
Owner

@xmengnet commented on GitHub (Dec 26, 2024):

add this resolved
···
location /ws {
proxy_pass http://127.0.0.1:4000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
proxy_read_timeout 3600; # 设置读取超时时间为3600秒
proxy_send_timeout 3600; # 设置发送超时时间为3600秒
}
···

<!-- gh-comment-id:2562363057 --> @xmengnet commented on GitHub (Dec 26, 2024): add this resolved ··· location /ws { proxy_pass http://127.0.0.1:4000; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_set_header Host $host; proxy_cache_bypass $http_upgrade; proxy_read_timeout 3600; # 设置读取超时时间为3600秒 proxy_send_timeout 3600; # 设置发送超时时间为3600秒 } ···
Author
Owner

@chenm1xuexi commented on GitHub (Dec 26, 2024):

add this resolved添加此已解决 ······ location /ws {位置 /ws { proxy_pass http://127.0.0.1:4000;proxy_pass http://127.0.0.1:4000; proxy_http_version 1.1;proxy_http_版本 1.1; proxy_set_header Upgrade $http_upgrade;proxy_set_header 升级 $http_upgrade; proxy_set_header Connection 'upgrade';proxy_set_header 连接“升级”; proxy_set_header Host $host;proxy_set_header 主机 $host; proxy_cache_bypass $http_upgrade;proxy_cache_bypass $http_upgrade; proxy_read_timeout 3600; # 设置读取超时时间为3600秒 proxy_send_timeout 3600; # 设置发送超时时间为3600秒 }} ······

I tried it, still the same error

this is my nginx config:

server {
listen 80;
server_name xxx.xxx.com;

location / {
    proxy_pass http://xx.xx.xx.xx:23333;

    # Standard headers
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

location /ws {
    proxy_pass http://xx.xx.xx.xx:23333;
    
    # Add WebSocket support
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    # Standard headers
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # Timeouts for WebSocket connections
    proxy_read_timeout 60s;
    proxy_send_timeout 60s;
}

}

<!-- gh-comment-id:2562366103 --> @chenm1xuexi commented on GitHub (Dec 26, 2024): > add this resolved添加此已解决 ······ location /ws {位置 /ws { proxy_pass http://127.0.0.1:4000;proxy_pass http://127.0.0.1:4000; proxy_http_version 1.1;proxy_http_版本 1.1; proxy_set_header Upgrade $http_upgrade;proxy_set_header 升级 $http_upgrade; proxy_set_header Connection 'upgrade';proxy_set_header 连接“升级”; proxy_set_header Host $host;proxy_set_header 主机 $host; proxy_cache_bypass $http_upgrade;proxy_cache_bypass $http_upgrade; proxy_read_timeout 3600; # 设置读取超时时间为3600秒 proxy_send_timeout 3600; # 设置发送超时时间为3600秒 }} ······ I tried it, still the same error this is my nginx config: server { listen 80; server_name xxx.xxx.com; location / { proxy_pass http://xx.xx.xx.xx:23333; # Standard headers proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /ws { proxy_pass http://xx.xx.xx.xx:23333; # Add WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; # Standard headers proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # Timeouts for WebSocket connections proxy_read_timeout 60s; proxy_send_timeout 60s; } }
Author
Owner

@Mushy-Snugglebites-badonkadonk commented on GitHub (Dec 26, 2024):

On a related note, this same issue arises while utilizing CloudFlare tunnels and there doesn't seem to be a clear fix for that compared to these adjustments to nginx for allowing websockets. I'll create a new issue for that, but in case anyone has some tips there that would be awesome.

Same boat here and wanted to chime in. Let me know if you find anything in CloudFlare’s console. I’ll post any findings here in the morning when I go to troubleshoot.

A quick search on DDG yields:
https://developers.cloudflare.com/network/websockets/

<!-- gh-comment-id:2562384435 --> @Mushy-Snugglebites-badonkadonk commented on GitHub (Dec 26, 2024): > On a related note, this same issue arises while utilizing CloudFlare tunnels and there doesn't seem to be a clear fix for that compared to these adjustments to nginx for allowing websockets. I'll create a new issue for that, but in case anyone has some tips there that would be awesome. Same boat here and wanted to chime in. Let me know if you find anything in CloudFlare’s console. I’ll post any findings here in the morning when I go to troubleshoot. A quick search on DDG yields: https://developers.cloudflare.com/network/websockets/
Author
Owner

@luzhao2 commented on GitHub (Dec 26, 2024):

I deployed the latest version 0.5.1 using docker, and the ng configuration supports web socket, but the system log prompt is INFO: xx.xx.xx.xx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG23yFx HTTP/1.1" 400 Bad Request When I roll back to version 0.4.8, the log is: INFO: xx.xx.xx.xx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG24X9C&sid=ncdWl4JHRt0k4D4zAAAC HTTP/1.1" 200 OK A new sid field has been added. I don't know if the official lack of this field caused the current problem. Please explain

I have added the above content and finally it works normally, but it didn't work properly before.
However, the logs still show some issues, although it doesn't affect my basic usage for now. But does this meet the project's expectations?
The logs are as follows:
open-webui | INFO: x.x.x.x:0 - "POST /api/v1/tasks/auto/completions HTTP/1.0" 400 Bad Request
open-webui | INFO: x.x.x.x:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG2NmkG HTTP/1.1" 400 Bad Request
open-webui | INFO: x.x.x.x:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG2NoBw HTTP/1.1" 400 Bad Request
open-webui | INFO: x.x.x.x:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG2Npfa HTTP/1.1" 400 Bad Request
open-webui | INFO: x.x.x.x:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG2Nr7T HTTP/1.1" 400 Bad Request

<!-- gh-comment-id:2562385235 --> @luzhao2 commented on GitHub (Dec 26, 2024): > I deployed the latest version 0.5.1 using docker, and the ng configuration supports web socket, but the system log prompt is INFO: xx.xx.xx.xx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG23yFx HTTP/1.1" 400 Bad Request When I roll back to version 0.4.8, the log is: INFO: xx.xx.xx.xx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG24X9C&sid=ncdWl4JHRt0k4D4zAAAC HTTP/1.1" 200 OK A new sid field has been added. I don't know if the official lack of this field caused the current problem. Please explain I have added the above content and finally it works normally, but it didn't work properly before. However, the logs still show some issues, although it doesn't affect my basic usage for now. But does this meet the project's expectations? The logs are as follows: open-webui | INFO: x.x.x.x:0 - "POST /api/v1/tasks/auto/completions HTTP/1.0" 400 Bad Request open-webui | INFO: x.x.x.x:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG2NmkG HTTP/1.1" 400 Bad Request open-webui | INFO: x.x.x.x:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG2NoBw HTTP/1.1" 400 Bad Request open-webui | INFO: x.x.x.x:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG2Npfa HTTP/1.1" 400 Bad Request open-webui | INFO: x.x.x.x:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG2Nr7T HTTP/1.1" 400 Bad Request
Author
Owner

@liucoj commented on GitHub (Dec 26, 2024):

I'm running OWUI installed locally on my machine via pip, no docker or nginix
INFO: 127.0.0.1:54424 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG2e3k- HTTP/1.1" 400 Bad Request
same error as above

<!-- gh-comment-id:2562473338 --> @liucoj commented on GitHub (Dec 26, 2024): I'm running OWUI installed locally on my machine via pip, no docker or nginix INFO: 127.0.0.1:54424 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG2e3k- HTTP/1.1" 400 Bad Request same error as above
Author
Owner

@littlelucky commented on GitHub (Dec 26, 2024):

I used LM Studio and encountered the same problem, and modifying the Nginx configuration did not work.
After testing, I found that LM Studio may not support this calling method.
The latest 0.5.1does not solve this problem.

<!-- gh-comment-id:2562531712 --> @littlelucky commented on GitHub (Dec 26, 2024): I used LM Studio and encountered the same problem, and modifying the Nginx configuration did not work. After testing, I found that LM Studio may not support this calling method. The latest 0.5.1does not solve this problem.
Author
Owner

@qdii commented on GitHub (Dec 26, 2024):

my nginx proxy configuration looks fine, websocket work.

Besides, the 400 error code from the backend.

❯ curl -i -N -H "Connection: Upgrade" -H "Upgrade: websocket" https://gpt.dodges.it/ws/socket.io
HTTP/2 400 
date: Thu, 26 Dec 2024 15:19:30 GMT
content-type: text/plain
x-process-time: 0
strict-transport-security: max-age=31536000; includeSubDomains

"Invalid transport"
<!-- gh-comment-id:2562882562 --> @qdii commented on GitHub (Dec 26, 2024): my nginx proxy configuration looks fine, websocket work. Besides, the 400 error code from the backend. ``` ❯ curl -i -N -H "Connection: Upgrade" -H "Upgrade: websocket" https://gpt.dodges.it/ws/socket.io HTTP/2 400 date: Thu, 26 Dec 2024 15:19:30 GMT content-type: text/plain x-process-time: 0 strict-transport-security: max-age=31536000; includeSubDomains "Invalid transport" ```
Author
Owner

@fawwazanvilen commented on GitHub (Dec 26, 2024):

proxy_pass http://127.0.0.1:8081;

Try to add another line with ws://127.0.0.1:8081

Nginx considers another proxy_pass line as a duplicate, as far as I know it should handle ws:// traffic by default as long as you already have an http:// proxy_pass.

I attempted making a more excessive nginx configuration:

server {
    listen              443 ssl http2;
    listen              [::]:443 ssl http2;
    server_name         openwebui.example.com;

    # SSL
    ssl_certificate     /etc/letsencrypt/live/openwebui.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/openwebui.example.com/privkey.pem;

    # security
    add_header X-XSS-Protection          "1; mode=block" always;
    add_header X-Content-Type-Options    "nosniff" always;
    add_header Referrer-Policy           "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy   "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
    add_header Permissions-Policy        "interest-cohort=()" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # . files
    location ~ /\.(?!well-known) {
        deny all;
    }

    # reverse proxy
    location / {
        proxy_pass            http://127.0.0.1:8081;
        proxy_set_header Host $host;

        proxy_http_version                 1.1;
        proxy_cache_bypass                 $http_upgrade;

        # Proxy SSL
        proxy_ssl_server_name              on;

        # Proxy headers
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        $connection_upgrade;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host  $host;
        proxy_set_header X-Forwarded-Port  $server_port;

        # Proxy timeouts
        proxy_connect_timeout              60s;
        proxy_send_timeout                 60s;
        proxy_read_timeout                 60s;
    }

}

The app seems to function correctly now, the titles do generate as well. However, I'm still getting the INFO messages in the console, suggesting that something is probably still not functioning correctly:

INFO:     xxx.xxx.xxx.xxx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG08v05 HTTP/1.1" 400 Bad Request
INFO:     xxx.xxx.xxx.xxx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG08vVE HTTP/1.1" 400 Bad Request
INFO:     xxx.xxx.xxx.xxx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG08vVE HTTP/1.1" 400 Bad Request

This time it's my client's IP instead of 127.0.0.1.

I don't have enough knowledge about networking to troubleshoot it further.

Edit: It appears that my older tabs were stuck in some kind of a loop sending requests to the server, after closing them and opening a fresh tab with open-webui I no longer see the INFO messages. The issue is resolved for me now, but maybe the project needs official nginx/apache/traefik/caddy configurations for people who use open-webui on a remote system.

i can confirm that this works, the chat title automatically generates, no 'session_id' errors appearing (it appeared when i just added these lines in the block below)

    # Add WebSocket support
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

but also i can confirm that i still get some errors much like what @ArakiSatoshi encounters

open-webui  | INFO:     [IP_ADDRESS]:0 - "GET /_app/immutable/nodes/14.Cr44g424.js HTTP/1.1" 304 Not Modified
open-webui  | INFO:     [IP_ADDRESS]:0 - "GET /api/v1/chats/[CHAT_ID] HTTP/1.1" 200 OK
open-webui  | INFO:     [IP_ADDRESS]:0 - "GET /api/v1/chats/all/tags HTTP/1.1" 200 OK
open-webui  | INFO:     [IP_ADDRESS]:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=[SESSION_ID] HTTP/1.1" 400 Bad Request
open-webui  | INFO:     [IP_ADDRESS]:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=[SESSION_ID] HTTP/1.1" 400 Bad Request
<!-- gh-comment-id:2562884083 --> @fawwazanvilen commented on GitHub (Dec 26, 2024): > > > proxy_pass http://127.0.0.1:8081; > > > > > > Try to add another line with ws://127.0.0.1:8081 > > Nginx considers another `proxy_pass` line as a duplicate, as far as I know it should handle `ws://` traffic by default as long as you already have an `http://` `proxy_pass`. > > I attempted making a more [excessive nginx configuration](https://github.com/digitalocean/nginxconfig.io): > > ``` > server { > listen 443 ssl http2; > listen [::]:443 ssl http2; > server_name openwebui.example.com; > > # SSL > ssl_certificate /etc/letsencrypt/live/openwebui.example.com/fullchain.pem; > ssl_certificate_key /etc/letsencrypt/live/openwebui.example.com/privkey.pem; > > # security > add_header X-XSS-Protection "1; mode=block" always; > add_header X-Content-Type-Options "nosniff" always; > add_header Referrer-Policy "no-referrer-when-downgrade" always; > add_header Content-Security-Policy "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always; > add_header Permissions-Policy "interest-cohort=()" always; > add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; > > # . files > location ~ /\.(?!well-known) { > deny all; > } > > # reverse proxy > location / { > proxy_pass http://127.0.0.1:8081; > proxy_set_header Host $host; > > proxy_http_version 1.1; > proxy_cache_bypass $http_upgrade; > > # Proxy SSL > proxy_ssl_server_name on; > > # Proxy headers > proxy_set_header Upgrade $http_upgrade; > proxy_set_header Connection $connection_upgrade; > proxy_set_header X-Real-IP $remote_addr; > proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; > proxy_set_header X-Forwarded-Proto $scheme; > proxy_set_header X-Forwarded-Host $host; > proxy_set_header X-Forwarded-Port $server_port; > > # Proxy timeouts > proxy_connect_timeout 60s; > proxy_send_timeout 60s; > proxy_read_timeout 60s; > } > > } > ``` > > The app seems to function correctly now, the titles do generate as well. However, I'm still getting the INFO messages in the console, suggesting that _something_ is probably still not functioning correctly: > > ``` > INFO: xxx.xxx.xxx.xxx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG08v05 HTTP/1.1" 400 Bad Request > INFO: xxx.xxx.xxx.xxx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG08vVE HTTP/1.1" 400 Bad Request > INFO: xxx.xxx.xxx.xxx:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG08vVE HTTP/1.1" 400 Bad Request > ``` > > This time it's my client's IP instead of 127.0.0.1. > > I don't have enough knowledge about networking to troubleshoot it further. > > **Edit:** It appears that my older tabs were stuck in some kind of a loop sending requests to the server, after closing them and opening a fresh tab with open-webui I no longer see the INFO messages. The issue is resolved for me now, but maybe the project needs official nginx/apache/traefik/caddy configurations for people who use open-webui on a remote system. i can confirm that **this works**, the chat title automatically generates, no `'session_id'` errors appearing (it appeared when i just added these lines in the block below) ``` # Add WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; ``` but also i can confirm that i **still get some errors** much like what @ArakiSatoshi encounters ``` open-webui | INFO: [IP_ADDRESS]:0 - "GET /_app/immutable/nodes/14.Cr44g424.js HTTP/1.1" 304 Not Modified open-webui | INFO: [IP_ADDRESS]:0 - "GET /api/v1/chats/[CHAT_ID] HTTP/1.1" 200 OK open-webui | INFO: [IP_ADDRESS]:0 - "GET /api/v1/chats/all/tags HTTP/1.1" 200 OK open-webui | INFO: [IP_ADDRESS]:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=[SESSION_ID] HTTP/1.1" 400 Bad Request open-webui | INFO: [IP_ADDRESS]:0 - "GET /ws/socket.io/?EIO=4&transport=polling&t=[SESSION_ID] HTTP/1.1" 400 Bad Request ```
Author
Owner

@qdii commented on GitHub (Dec 26, 2024):

I think there are two distinct problems introduced in 0.5.0:

  1. there is the fact that websocket are used, and this breaks people whose reverse proxy isn't configured correctly
  2. there is /ws/socket.io/ returning 400 status code.

The first problem is solved, let's keep this thread open for the second

<!-- gh-comment-id:2562890210 --> @qdii commented on GitHub (Dec 26, 2024): I think there are two distinct problems introduced in 0.5.0: 1. there is the fact that websocket are used, and this breaks people whose reverse proxy isn't configured correctly 2. there is `/ws/socket.io/` returning 400 status code. The first problem is solved, let's keep this thread open for the second
Author
Owner

@oldskewlcool commented on GitHub (Dec 26, 2024):

One additional step needed to solve the nginx configuration issue was to add \ in front of all the $ variables if nginx was installed using docker / docker compose.

Without this step nginx would not start and instead threw the following:

nginx: [emerg] invalid number of arguments in "proxy_set_header" directive in /etc/nginx/conf.d/reverse-proxy.conf:14

The solution given here worked fine when the variables were changed to $http_upgrade, $host etc..

<!-- gh-comment-id:2562937746 --> @oldskewlcool commented on GitHub (Dec 26, 2024): One additional step needed to solve the nginx configuration issue was to add \ in front of all the $ variables if nginx was installed using docker / docker compose. Without this step nginx would not start and instead threw the following: nginx: [emerg] invalid number of arguments in "proxy_set_header" directive in /etc/nginx/conf.d/reverse-proxy.conf:14 The solution given here worked fine when the variables were changed to \$http_upgrade, \$host etc..
Author
Owner

@Mushy-Snugglebites-badonkadonk commented on GitHub (Dec 26, 2024):

On a related note, this same issue arises while utilizing CloudFlare tunnels and there doesn't seem to be a clear fix for that compared to these adjustments to nginx for allowing websockets. I'll create a new issue for that, but in case anyone has some tips there that would be awesome.

Same boat here and wanted to chime in. Let me know if you find anything in CloudFlare’s console. I’ll post any findings here in the morning when I go to troubleshoot.

A quick search on DDG yields: https://developers.cloudflare.com/network/websockets/

  • Websockets was enabled prior to upgrading to v0.5.0 when network issue and error 400 issues were present.
  • Local LLM and OpenAI GPT-4o mini performance has been restored in v0.5.1. No error 400 present.
  • Additionally, OWUI loading, responsiveness, and long chat thread loading performance is back to being on par for the course.
  • Streaming GPT-4o mini works great, just wish token count was available; an OpenAI API server side issue is the probable cause.
  • Local streaming with Neural Daredevil is painful slow even on an RTX 4090. I started a regenerate response command 3 minutes ago and the LLM is still working.

@tjbck REQUEST: Please disable streaming response by default.

<!-- gh-comment-id:2563016654 --> @Mushy-Snugglebites-badonkadonk commented on GitHub (Dec 26, 2024): > > On a related note, this same issue arises while utilizing CloudFlare tunnels and there doesn't seem to be a clear fix for that compared to these adjustments to nginx for allowing websockets. I'll create a new issue for that, but in case anyone has some tips there that would be awesome. > > Same boat here and wanted to chime in. Let me know if you find anything in CloudFlare’s console. I’ll post any findings here in the morning when I go to troubleshoot. > > A quick search on DDG yields: https://developers.cloudflare.com/network/websockets/ - Websockets was enabled prior to upgrading to v0.5.0 when network issue and error 400 issues were present. - Local LLM and OpenAI GPT-4o mini performance has been restored in v0.5.1. No error 400 present. - Additionally, OWUI loading, responsiveness, and long chat thread loading performance is back to being on par for the course. - Streaming GPT-4o mini works great, just wish token count was available; an OpenAI API server side issue is the probable cause. - Local streaming with Neural Daredevil is painful slow even on an RTX 4090. I started a regenerate response command 3 minutes ago and the LLM is still working. **@tjbck REQUEST: Please disable streaming response by default.**
Author
Owner

@knguyen298 commented on GitHub (Dec 26, 2024):

Encountered something similar which turned out to be a pretty silly fix:

I'm using Open-WebUI behind Traefik, which has websocket support standard, so no need for extra headers. However, I was still getting the /ws/socket.io/?EIO=4&transport=polling&t=[SESSION_ID] HTTP/1.1" 400 Bad Request error showing up in console. The error had the IP address from my home's public IP, but accessing my instance from work yielded no errors. I tried disabling CloudFlare proxying, as I know it can cause issues with websockets.

Turns out, I still had an Open-WebUI instance open on my home computer from before the 0.5.0 update which was causing the error. After closing it the window, the errors went away.

<!-- gh-comment-id:2563073145 --> @knguyen298 commented on GitHub (Dec 26, 2024): Encountered something similar which turned out to be a pretty silly fix: I'm using Open-WebUI behind Traefik, which has websocket support standard, so no need for extra headers. However, I was still getting the `/ws/socket.io/?EIO=4&transport=polling&t=[SESSION_ID] HTTP/1.1" 400 Bad Request` error showing up in console. The error had the IP address from my home's public IP, but accessing my instance from work yielded no errors. I tried disabling CloudFlare proxying, as I know it can cause issues with websockets. Turns out, I still had an Open-WebUI instance open on my home computer from before the 0.5.0 update which was causing the error. After closing it the window, the errors went away.
Author
Owner

@glsup commented on GitHub (Dec 27, 2024):

I also got the "GET /ws/socket.io... 400 Bad Request "logs + "session_id" + can't chat anymore (complained about previous answer) after updating to both 0.5.0 and 0.5.1, from 0.4.8.

I use the git install (git pull origin main) and starting the server, in Windows, with ./backend/start_windows.bat

So I did a "checkout" to the 0.4.8 version (that used to work fine), and now it works fine (no logs nor errors and can chat again).

For some reason 0.5.x don't work for me.

<!-- gh-comment-id:2563180646 --> @glsup commented on GitHub (Dec 27, 2024): I also got the "GET /ws/socket.io... 400 Bad Request "logs + "session_id" + can't chat anymore (complained about previous answer) after updating to both 0.5.0 and 0.5.1, from 0.4.8. I use the git install (git pull origin main) and starting the server, in Windows, with ./backend/start_windows.bat So I did a "checkout" to the 0.4.8 version (that used to work fine), and now it works fine (no logs nor errors and can chat again). For some reason 0.5.x don't work for me.
Author
Owner

@martin-rizzo commented on GitHub (Dec 27, 2024):

I'm having the exact same problem. I'm using Fedora and I install open-webui directly from the repository. I run it as a regular user on my system (no Docker). I can't use version 0.5.0 or any later versions because of the 400 Bad Request errors and the "session_id" issues described in this thread. Since I don't have much experience with server administration, I'm not sure if version 0.5.0 and newer now require me to install nginx, change firewall settings, or configure some other service. Any help or guidance on how to fix this issue would be greatly appreciated.

<!-- gh-comment-id:2563199655 --> @martin-rizzo commented on GitHub (Dec 27, 2024): I'm having the exact same problem. I'm using Fedora and I install open-webui directly from the repository. I run it as a regular user on my system (no Docker). I can't use version 0.5.0 or any later versions because of the 400 Bad Request errors and the "session_id" issues described in this thread. Since I don't have much experience with server administration, I'm not sure if version 0.5.0 and newer now require me to install nginx, change firewall settings, or configure some other service. Any help or guidance on how to fix this issue would be greatly appreciated.
Author
Owner

@cangming commented on GitHub (Dec 27, 2024):

I'm experiencing a similar issue after upgrade to 0.5.1 from 0.4.7. I'm confident that the Nginx reverse proxy is correctly configured with the necessary headers for WebSocket support.
image

nginx config would be as following.

    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name xxxx;
    ...

    location / {
        proxy_connect_timeout 60;
        proxy_read_timeout 60;
        proxy_send_timeout 60;
        proxy_intercept_errors off;
        proxy_http_version 1.1;
        proxy_set_header        Upgrade            $http_upgrade;
        proxy_set_header        Connection            $connection_upgrade;
        proxy_set_header        Host            $http_host;
        proxy_set_header        X-Real-IP            $remote_addr;
        proxy_set_header        X-Forwarded-For            $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto            $scheme;
        proxy_pass http://{docker container ip}:8080;
    }
   ...

I try to disable nginx web socket proxy header and will get logs as following

"GET /ws/socket.io/?EIO=4&transport=websocket HTTP/1.1" 400 Bad Request
"GET /ws/socket.io/?EIO=4&transport=polling&t=PG6z4R4 HTTP/1.1" 400 Bad Request
"GET /ws/socket.io/?EIO=4&transport=polling&t=PG6z4RV HTTP/1.1" 400 Bad Request
"GET /ws/socket.io/?EIO=4&transport=polling&t=PG6z4Rk HTTP/1.1" 400 Bad Request
"GET /ws/socket.io/?EIO=4&transport=websocket HTTP/1.1" 400 Bad Request
"GET /ws/socket.io/?EIO=4&transport=polling&t=PG6z5uq HTTP/1.1" 400 Bad Request
"GET /ws/socket.io/?EIO=4&transport=polling&t=PG6z5vE HTTP/1.1" 400 Bad Request

It's not only show transport=polling but also transport=websocket failed too.
But if I enable header again, I can get the info log which say WebSocket connection open.

INFO:     ('XXX.XXX.XXX.XXX', 0) - "WebSocket /ws/socket.io/?EIO=4&transport=websocket" [accepted]                                                                   
INFO:     connection open
...
INFO:     ('XXX.XXX.XXX.XXX', 0) - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG6-SK4 HTTP/1.1" 400 Bad Request
INFO:     ('XXX.XXX.XXX.XXX', 0) - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG6-SKQ HTTP/1.1" 400 Bad Request
INFO:     ('XXX.XXX.XXX.XXX', 0) - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG6-Tnq HTTP/1.1" 400 Bad Request

I checked the debug tool in the Chrome browser and confirmed that data was indeed being transmitted via the WebSocket connection. However, the byte count sent through the WebSocket is very low each time, and the frequency is extremely low, resulting in a very slow response on the UI. I'm not sure if this is related to the issue.

Unable to tolerate it any longer, I eventually reverted back to version 0.4.8, and fortunately, all functions are working properly, and the UI response speed has returned to normal.

<!-- gh-comment-id:2563304092 --> @cangming commented on GitHub (Dec 27, 2024): I'm experiencing a similar issue after upgrade to 0.5.1 from 0.4.7. I'm confident that the Nginx reverse proxy is correctly configured with the necessary headers for WebSocket support. ![image](https://github.com/user-attachments/assets/6dea1497-dcc2-4d62-bd14-039dfc1a8126) nginx config would be as following. ``` map $http_upgrade $connection_upgrade { default upgrade; '' close; } server { listen 443 ssl; listen [::]:443 ssl; server_name xxxx; ... location / { proxy_connect_timeout 60; proxy_read_timeout 60; proxy_send_timeout 60; proxy_intercept_errors off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://{docker container ip}:8080; } ... ``` I try to disable nginx web socket proxy header and will get logs as following ``` "GET /ws/socket.io/?EIO=4&transport=websocket HTTP/1.1" 400 Bad Request "GET /ws/socket.io/?EIO=4&transport=polling&t=PG6z4R4 HTTP/1.1" 400 Bad Request "GET /ws/socket.io/?EIO=4&transport=polling&t=PG6z4RV HTTP/1.1" 400 Bad Request "GET /ws/socket.io/?EIO=4&transport=polling&t=PG6z4Rk HTTP/1.1" 400 Bad Request "GET /ws/socket.io/?EIO=4&transport=websocket HTTP/1.1" 400 Bad Request "GET /ws/socket.io/?EIO=4&transport=polling&t=PG6z5uq HTTP/1.1" 400 Bad Request "GET /ws/socket.io/?EIO=4&transport=polling&t=PG6z5vE HTTP/1.1" 400 Bad Request ``` It's not only show transport=polling but also transport=websocket failed too. But if I enable header again, I can get the info log which say WebSocket connection open. ``` INFO: ('XXX.XXX.XXX.XXX', 0) - "WebSocket /ws/socket.io/?EIO=4&transport=websocket" [accepted] INFO: connection open ... INFO: ('XXX.XXX.XXX.XXX', 0) - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG6-SK4 HTTP/1.1" 400 Bad Request INFO: ('XXX.XXX.XXX.XXX', 0) - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG6-SKQ HTTP/1.1" 400 Bad Request INFO: ('XXX.XXX.XXX.XXX', 0) - "GET /ws/socket.io/?EIO=4&transport=polling&t=PG6-Tnq HTTP/1.1" 400 Bad Request ``` I checked the debug tool in the Chrome browser and confirmed that data was indeed being transmitted via the WebSocket connection. However, the byte count sent through the WebSocket is very low each time, and the frequency is extremely low, resulting in a very slow response on the UI. I'm not sure if this is related to the issue. Unable to tolerate it any longer, I eventually reverted back to version 0.4.8, and fortunately, all functions are working properly, and the UI response speed has returned to normal.
Author
Owner

@gaby commented on GitHub (Dec 27, 2024):

@PhilosophiMoonbeam Solutions works great, it should be included in the docs and an example.

<!-- gh-comment-id:2563702861 --> @gaby commented on GitHub (Dec 27, 2024): @PhilosophiMoonbeam Solutions works great, it should be included in the docs and an example.
Author
Owner

@liucoj commented on GitHub (Dec 27, 2024):

After updating to 0.52 (manual install, no docker) and cleaning browser caches issue is gone.
('127.0.0.1', 50358) - "WebSocket /ws/socket.io/?EIO=4&transport=websocket" [accepted]

Note:
version 0.52 at first run gave me the same error (400) but I noticed that version info on Settings was still 0.48, so I cleaned browser's caches and restart OWui and it showed the correct version and issue is gone.

<!-- gh-comment-id:2563843055 --> @liucoj commented on GitHub (Dec 27, 2024): After updating to 0.52 (manual install, no docker) and cleaning browser caches issue is gone. ('127.0.0.1', 50358) - "WebSocket /ws/socket.io/?EIO=4&transport=websocket" [accepted] Note: version 0.52 at first run gave me the same error (400) but I noticed that version info on Settings was still 0.48, so I cleaned browser's caches and restart OWui and it showed the correct version and issue is gone.
Author
Owner

@Raxel01 commented on GitHub (Dec 27, 2024):

For any one faced The Same error with the setup of : docker-docker/compose + nginx
You will just need to enable nginx websockets support using this two lines :

  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
<!-- gh-comment-id:2563843774 --> @Raxel01 commented on GitHub (Dec 27, 2024): For any one faced The Same error with the setup of : docker-docker/compose + nginx You will just need to enable nginx websockets support using this two lines : proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade";
Author
Owner

@martin-rizzo commented on GitHub (Dec 27, 2024):

I fixed the problem by doing a fresh install (I'm not using Docker, I'm running open-webui directly from the repo). After deleting all the old files and doing a clean git clone, I reinstalled the backend dependencies and did a full frontend build. This fixed all the problems I was having with version 0.5.2. It looks like something on my end wasn't updated properly. Hopefully this helps anyone else having the same issues. Thanks!

<!-- gh-comment-id:2564086742 --> @martin-rizzo commented on GitHub (Dec 27, 2024): I fixed the problem by doing a fresh install (I'm not using Docker, I'm running open-webui directly from the repo). After deleting all the old files and doing a clean git clone, I reinstalled the backend dependencies and did a full frontend build. This fixed all the problems I was having with version 0.5.2. It looks like something on my end wasn't updated properly. Hopefully this helps anyone else having the same issues. Thanks!
Author
Owner

@dylanarmstrong commented on GitHub (Dec 28, 2024):

For caddy I fixed by adding the following option to the reverse_proxy. Assuming you are using docker or another setup where reverse_proxy is appropriate. I think my websockets were never working and it only became a problem recently

    reverse_proxy localhost:3000 {
        header_up Host {host}
        header_up X-Real-IP {remote}
        header_up X-Forwarded-For {remote}
        header_up X-Forwarded-Proto {scheme}
    }

I tried this, but it didn't fix it for me unfortunately. Getting a 400 on the wss request and unsure how to really debug it. Will downgrade to 0.4.8.

<!-- gh-comment-id:2564295309 --> @dylanarmstrong commented on GitHub (Dec 28, 2024): > For caddy I fixed by adding the following option to the reverse_proxy. Assuming you are using docker or another setup where reverse_proxy is appropriate. I think my websockets were never working and it only became a problem recently > > ``` > reverse_proxy localhost:3000 { > header_up Host {host} > header_up X-Real-IP {remote} > header_up X-Forwarded-For {remote} > header_up X-Forwarded-Proto {scheme} > } > ``` I tried this, but it didn't fix it for me unfortunately. Getting a 400 on the wss request and unsure how to really debug it. Will downgrade to 0.4.8.
Author
Owner

@arsaboo commented on GitHub (Dec 29, 2024):

Is anyone able to fix this in Nginx Proxy Manager? I tried the following:

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_cache_bypass $http_upgrade;

image

But that does not work. Any suggestions?

<!-- gh-comment-id:2564583223 --> @arsaboo commented on GitHub (Dec 29, 2024): Is anyone able to fix this in Nginx Proxy Manager? I tried the following: ```yaml proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_cache_bypass $http_upgrade; ``` ![image](https://github.com/user-attachments/assets/9e745361-fde7-40d2-9dc1-fae02d0c8a50) But that does not work. Any suggestions?
Author
Owner

@toniexly commented on GitHub (Dec 29, 2024):

Is anyone able to fix this in Nginx Proxy Manager? I tried the following:

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_cache_bypass $http_upgrade;

image

But that does not work. Any suggestions?

go to the details tab and activate the websocket support. leave the custom config tab empty. this should work, but still the response time of 0.5.2 is way too slow(don't know why). i think i'll roll back to 0.4.8 for now...for better performance.

<!-- gh-comment-id:2564611388 --> @toniexly commented on GitHub (Dec 29, 2024): > Is anyone able to fix this in Nginx Proxy Manager? I tried the following: > > ```yaml > proxy_set_header Upgrade $http_upgrade; > proxy_set_header Connection "upgrade"; > proxy_set_header Host $host; > proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; > proxy_cache_bypass $http_upgrade; > ``` > > ![image](https://private-user-images.githubusercontent.com/18319734/399133090-9e745361-fde7-40d2-9dc1-fae02d0c8a50.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MzU0NDcxODAsIm5iZiI6MTczNTQ0Njg4MCwicGF0aCI6Ii8xODMxOTczNC8zOTkxMzMwOTAtOWU3NDUzNjEtZmRlNy00MGQyLTlkYzEtZmFlMDJkMGM4YTUwLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDEyMjklMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQxMjI5VDA0MzQ0MFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWQ0OGFmOGI4MWNiMjg4YWRiMGUxYjMxMDE4MjRiM2FmMmE5MzRmNDkzNmQyZDg1OWRjNjAyMjliYjk5NTMxOGImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.pVyq0Zcws55lSzgfqbCvW8Xs4-DH7nru0L8YxkWVUio) > > But that does not work. Any suggestions? go to the details tab and activate the websocket support. leave the custom config tab empty. this should work, but still the response time of 0.5.2 is way too slow(don't know why). i think i'll roll back to 0.4.8 for now...for better performance.
Author
Owner

@tjbck commented on GitHub (Dec 29, 2024):

@toniexly Related: https://github.com/open-webui/open-webui/discussions/8088

tl;dr: you should able to disable ENABLE_REALTIME_CHAT_SAVE with env var starting from 0.5.3+ (w/ some compromises)

<!-- gh-comment-id:2564621095 --> @tjbck commented on GitHub (Dec 29, 2024): @toniexly Related: https://github.com/open-webui/open-webui/discussions/8088 tl;dr: you should able to disable `ENABLE_REALTIME_CHAT_SAVE` with env var starting from 0.5.3+ (w/ some compromises)
Author
Owner

@SergioMendolia commented on GitHub (Dec 29, 2024):

@arsaboo I could fix it in NPM with

  • The checkbox for websockets in the "details" tab
  • The following configuration in the "advanced tab":
    proxy_set_header X-Forwarded-Scheme $forward_scheme; proxy_set_header X-Forwarded-Proto $forward_scheme;
<!-- gh-comment-id:2564642422 --> @SergioMendolia commented on GitHub (Dec 29, 2024): @arsaboo I could fix it in NPM with - The checkbox for websockets in the "details" tab - The following configuration in the "advanced tab": `proxy_set_header X-Forwarded-Scheme $forward_scheme; proxy_set_header X-Forwarded-Proto $forward_scheme;`
Author
Owner

@oatmealm commented on GitHub (Dec 29, 2024):

I'm not sure if this is related, but conversation with external services seems to never close automatically. This doesn't happen with ollama only with external providers. I need to manually stop the conversation even though streaming stopped.

image

<!-- gh-comment-id:2564674278 --> @oatmealm commented on GitHub (Dec 29, 2024): I'm not sure if this is related, but conversation with external services seems to never close automatically. This doesn't happen with ollama only with external providers. I need to manually stop the conversation even though streaming stopped. ![image](https://github.com/user-attachments/assets/4c08fe98-b81f-4a59-a2ae-5f2170569cfb)
Author
Owner

@arsaboo commented on GitHub (Dec 29, 2024):

@arsaboo I could fix it in NPM with

  • The checkbox for websockets in the "details" tab
  • The following configuration in the "advanced tab":
    proxy_set_header X-Forwarded-Scheme $forward_scheme; proxy_set_header X-Forwarded-Proto $forward_scheme;

Thanks @SergioMendolia looks like that is working. Finally, I added the following four directives:

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Forwarded-Scheme $forward_scheme;
proxy_set_header X-Forwarded-Proto $forward_scheme;
<!-- gh-comment-id:2564752171 --> @arsaboo commented on GitHub (Dec 29, 2024): > @arsaboo I could fix it in NPM with > > * The checkbox for websockets in the "details" tab > * The following configuration in the "advanced tab": > `proxy_set_header X-Forwarded-Scheme $forward_scheme; proxy_set_header X-Forwarded-Proto $forward_scheme;` Thanks @SergioMendolia looks like that is working. Finally, I added the following four directives: ```yaml proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header X-Forwarded-Scheme $forward_scheme; proxy_set_header X-Forwarded-Proto $forward_scheme; ```
Author
Owner

@ben-vargas commented on GitHub (Dec 29, 2024):

If you use the nginx web configurator, this is as simple as making sure the "Websockets Support" is toggled on for the proxy host you've added for Open WebuUI.

My Open WebUI had stopped working after the recent update, but I didn't have websockets enabled on the proxy host; doing so resolved the issue without any manual file changes. You can then also use the "Advanced" tab if you need to change any parameters such as timeout, but OpenWeb UI started working after simply enabling web sockets and restarting the docker container.

<!-- gh-comment-id:2564839111 --> @ben-vargas commented on GitHub (Dec 29, 2024): If you use the nginx web configurator, this is as simple as making sure the "Websockets Support" is toggled on for the proxy host you've added for Open WebuUI. My Open WebUI had stopped working after the recent update, but I didn't have websockets enabled on the proxy host; doing so resolved the issue without any manual file changes. You can then also use the "Advanced" tab if you need to change any parameters such as timeout, but OpenWeb UI started working after simply enabling web sockets and restarting the docker container.
Author
Owner

@Davester34 commented on GitHub (Dec 30, 2024):

I'm really new to Open WebUI but I just updated, noticed things were slow, checked the logs to see what was happening and I get

INFO: 172.17.0.1:60294 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PGNhoIy HTTP/1.1" 400 Bad Request

every second or so.

Not sure if the following is relevant:
I don't think I'm using ngix anything, i just have a default install from docker. When I updated the docker from command line, I used the docker line for Nvidia cards, the line with ALL GPUs or whatever.

The initial installation I used the first docker command that says 'if you have ollama installed on this computer'

I'm thinking this is related to my issue. probably a network config line somewhere but I'm not sure where to start. I can go to the terminal # prompt in docker but i don't know where to find the network configuration files. Hoping someone can help?

Sample snip from log...
INFO: 172.17.0.1:33762 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PGOaJrw HTTP/1.1" 400 Bad Request
INFO: 172.17.0.1:33778 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PGOaJ-2 HTTP/1.1" 400 Bad Request
INFO: 172.17.0.1:35120 - "POST /api/v1/images/generations HTTP/1.1" 200 OK
INFO: 172.17.0.1:35120 - "POST /api/v1/chats/229899fa-dbfd-4f4c-9031-83331a4e427c HTTP/1.1" 200 OK
INFO: 172.17.0.1:33790 - "GET /cache/image/generations/f8db7fbc-7abd-4a4c-b198-225db608be4b.png HTTP/1.1" 200 OK
INFO: 172.17.0.1:35120 - "GET /api/v1/chats/?page=1 HTTP/1.1" 200 OK
INFO: 172.17.0.1:33806 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PGOaLCa HTTP/1.1" 400 Bad Request
INFO: 172.17.0.1:33806 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PGOaLCw HTTP/1.1" 400 Bad Request

<!-- gh-comment-id:2565471713 --> @Davester34 commented on GitHub (Dec 30, 2024): I'm really new to Open WebUI but I just updated, noticed things were slow, checked the logs to see what was happening and I get INFO: 172.17.0.1:60294 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PGNhoIy HTTP/1.1" 400 Bad Request every second or so. Not sure if the following is relevant: I don't think I'm using ngix anything, i just have a default install from docker. When I updated the docker from command line, I used the docker line for Nvidia cards, the line with ALL GPUs or whatever. The initial installation I used the first docker command that says 'if you have ollama installed on this computer' I'm thinking this is related to my issue. probably a network config line somewhere but I'm not sure where to start. I can go to the terminal # prompt in docker but i don't know where to find the network configuration files. Hoping someone can help? Sample snip from log... INFO: 172.17.0.1:33762 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PGOaJrw HTTP/1.1" 400 Bad Request INFO: 172.17.0.1:33778 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PGOaJ-2 HTTP/1.1" 400 Bad Request INFO: 172.17.0.1:35120 - "POST /api/v1/images/generations HTTP/1.1" 200 OK INFO: 172.17.0.1:35120 - "POST /api/v1/chats/229899fa-dbfd-4f4c-9031-83331a4e427c HTTP/1.1" 200 OK INFO: 172.17.0.1:33790 - "GET /cache/image/generations/f8db7fbc-7abd-4a4c-b198-225db608be4b.png HTTP/1.1" 200 OK INFO: 172.17.0.1:35120 - "GET /api/v1/chats/?page=1 HTTP/1.1" 200 OK INFO: 172.17.0.1:33806 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PGOaLCa HTTP/1.1" 400 Bad Request INFO: 172.17.0.1:33806 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PGOaLCw HTTP/1.1" 400 Bad Request
Author
Owner

@bash-bandicoot commented on GitHub (Dec 30, 2024):

Thanks to @tjbck for your hint; I was able to fix this. Basically, I am using Apache on my server as a proxy to my Docker container, and I had the following lines:

ProxyPass / http://127.0.0.1:5598/
ProxyPassReverse / http://127.0.0.1:5598/

I simply changed them to:

ProxyPass / http://127.0.0.1:5598/
ProxyPassReverse / http://127.0.0.1:5598/
<Location />       
    ProxyPass ws://localhost:5598/
    ProxyPassReverse ws://localhost:5598/
</Location>

PROOF: Screenshot 2024-12-25 235127

For now everything is working fine!

Confirming works with open-web-ui docker wrapped with Apache.
Thanks a ton, @Simi5599 and @tjbck!

<!-- gh-comment-id:2565575369 --> @bash-bandicoot commented on GitHub (Dec 30, 2024): > Thanks to @tjbck for your hint; I was able to fix this. Basically, I am using Apache on my server as a proxy to my Docker container, and I had the following lines: > > ``` > ProxyPass / http://127.0.0.1:5598/ > ProxyPassReverse / http://127.0.0.1:5598/ > ``` > > I simply changed them to: > > ``` > ProxyPass / http://127.0.0.1:5598/ > ProxyPassReverse / http://127.0.0.1:5598/ > <Location /> > ProxyPass ws://localhost:5598/ > ProxyPassReverse ws://localhost:5598/ > </Location> > ``` > > PROOF: ![Screenshot 2024-12-25 235127](https://private-user-images.githubusercontent.com/58948851/398603336-f4a3b15e-b24e-44a6-941b-742aefd5bc22.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MzU1NzAyMzksIm5iZiI6MTczNTU2OTkzOSwicGF0aCI6Ii81ODk0ODg1MS8zOTg2MDMzMzYtZjRhM2IxNWUtYjI0ZS00NGE2LTk0MWItNzQyYWVmZDViYzIyLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDEyMzAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQxMjMwVDE0NDUzOVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWI3OGI3YjZjZTQ4ZTg1Y2FhOGJjN2U4MGJhOWQ4YmNiOThmNDJkODYxMWUyNGQ1MDFkZjIxMzU0OGNiY2MxMmUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.oPvamFdQ8CyWIW-rWF0bHdaM6ajBUkzBJu4kmOvM8QM) > > For now everything is working fine! Confirming works with open-web-ui docker wrapped with Apache. Thanks a ton, @Simi5599 and @tjbck!
Author
Owner

@Davester34 commented on GitHub (Dec 30, 2024):

@Simi5599 Thanks for the update, let's keep this issue open for other users to find your solution!

That fixes it for him using Apache server. I'm not using Apache server and have this error, so do I create a new issue for my problems? (New to all this, sorry if this is a noob question)

I have my details posted in this thread ( https://github.com/open-webui/open-webui/issues/8074#issuecomment-2565471713 )

<!-- gh-comment-id:2565874496 --> @Davester34 commented on GitHub (Dec 30, 2024): > @Simi5599 Thanks for the update, let's keep this issue open for other users to find your solution! That fixes it for him using Apache server. I'm not using Apache server and have this error, so do I create a new issue for my problems? (New to all this, sorry if this is a noob question) I have my details posted in this thread ( https://github.com/open-webui/open-webui/issues/8074#issuecomment-2565471713 )
Author
Owner

@Simi5599 commented on GitHub (Dec 30, 2024):

I'm not using Apache server

Are you using Nginx? There are some people above who were successful with their configurations

<!-- gh-comment-id:2565904223 --> @Simi5599 commented on GitHub (Dec 30, 2024): > I'm not using Apache server Are you using Nginx? There are some people above who were successful with their configurations
Author
Owner

@elharony commented on GitHub (Dec 31, 2024):

I had the same issue today after upgrading to v0.5.2 on AWS EC2 + Docker with Nginx as a reverse proxy, and I fixed it by adding WebSocket support to the Nginx configuration.

Steps to Fix:

1. Open your Nginx configuration file:

sudo vim /etc/nginx/nginx.conf

2. Replace the old server block with this updated configuration:

# New Server Block for your-domain.com
server {
    listen 80;
    server_name your-domain.com;

    location / {
        proxy_pass http://localhost:3000;

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Preserve client information
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Save and quit Vim (:wq).**

3. Test the Nginx configuration for syntax errors:

sudo nginx -t

You should see: nginx: configuration file /etc/nginx/nginx.conf test is successful

4. Reload Nginx to apply the changes:

sudo systemctl reload nginx

And it works perfectly now! 🚀

<!-- gh-comment-id:2566228618 --> @elharony commented on GitHub (Dec 31, 2024): I had the same issue today after upgrading to **v0.5.2** on **AWS EC2 + Docker** with **Nginx as a reverse proxy**, and I fixed it by adding WebSocket support to the Nginx configuration. ## Steps to Fix: **1. Open your Nginx configuration file:** ```bash sudo vim /etc/nginx/nginx.conf ``` **2. Replace the old server block with this updated configuration:** ```nginx # New Server Block for your-domain.com server { listen 80; server_name your-domain.com; location / { proxy_pass http://localhost:3000; # WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; # Preserve client information proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } ``` Save and quit Vim (`:wq`).** **3. Test the Nginx configuration for syntax errors:** ```bash sudo nginx -t ``` You should see: `nginx: configuration file /etc/nginx/nginx.conf test is successful` **4. Reload Nginx to apply the changes:** ```bash sudo systemctl reload nginx ``` And it works perfectly now! 🚀
Author
Owner

@debeetle commented on GitHub (Dec 31, 2024):

Turning off the title auto-generation works for me

<!-- gh-comment-id:2566482512 --> @debeetle commented on GitHub (Dec 31, 2024): Turning off the title auto-generation works for me
Author
Owner

@adri-k commented on GitHub (Dec 31, 2024):

I have the same 400 bad request issue on web socket calls.
I am not using an nginx proxy or apache, just a docker installtation of open webui 0.5.2.
The same error also existed in version 0.5 and 0.5.1.

<!-- gh-comment-id:2566564589 --> @adri-k commented on GitHub (Dec 31, 2024): I have the same 400 bad request issue on web socket calls. I am not using an nginx proxy or apache, just a docker installtation of open webui 0.5.2. The same error also existed in version 0.5 and 0.5.1.
Author
Owner

@yoavain commented on GitHub (Dec 31, 2024):

I have the same issue with 0.5+ and only when using my external hostname. I use my NAS's reverse proxy.
When using localhost it works.
Works fine on 0.4.8.

Setup:
Windows 11
Docker (running with --add-host=host.docker.internal:host-gateway)

<!-- gh-comment-id:2566620199 --> @yoavain commented on GitHub (Dec 31, 2024): I have the same issue with 0.5+ and only when using my external hostname. I use my NAS's reverse proxy. When using `localhost` it works. Works fine on 0.4.8. Setup: Windows 11 Docker (running with `--add-host=host.docker.internal:host-gateway`)
Author
Owner

@cangming commented on GitHub (Jan 1, 2025):

After upgrading to v0.5.3 and setting the Docker environment variable ENABLE_REALTIME_CHAT_SAVE to False, the issue of slow UI response speed has been successfully resolved. Thank you very much.

@toniexly Related: #8088

tl;dr: you should able to disable ENABLE_REALTIME_CHAT_SAVE with env var starting from 0.5.3+ (w/ some compromises)

<!-- gh-comment-id:2566842411 --> @cangming commented on GitHub (Jan 1, 2025): After upgrading to v0.5.3 and setting the Docker environment variable ENABLE_REALTIME_CHAT_SAVE to False, the issue of slow UI response speed has been successfully resolved. Thank you very much. > @toniexly Related: #8088 > > tl;dr: you should able to disable `ENABLE_REALTIME_CHAT_SAVE` with env var starting from 0.5.3+ (w/ some compromises)
Author
Owner

@krishkumar commented on GitHub (Jan 1, 2025):

I encountered a similar issue since upgrading OpenWebUI on my CapRover instance. I managed to resolve it by enabling "WebSocket support" through the CapRover dashboard settings.

<!-- gh-comment-id:2567013442 --> @krishkumar commented on GitHub (Jan 1, 2025): I encountered a similar issue since upgrading OpenWebUI on my CapRover instance. I managed to resolve it by enabling "WebSocket support" through the CapRover dashboard settings.
Author
Owner

@danielj23 commented on GitHub (Jan 1, 2025):

I was getting this since the same build.

Using Nginx proxy manager, I enabled Websockets Support under Details, and http2 support under SSL tab and my problem was resolved.

<!-- gh-comment-id:2567058501 --> @danielj23 commented on GitHub (Jan 1, 2025): I was getting this since the same build. Using Nginx proxy manager, I enabled Websockets Support under Details, and http2 support under SSL tab and my problem was resolved.
Author
Owner

@MattariOnline commented on GitHub (Jan 1, 2025):

Also having this issue, but adding the various headers, http2, and even the portion commented as "security" didn't work (added them incrementally). Doesn't work from either of my two domains, nor through my CloudFlare connection. Only works with a LAN address.
Desperate for help if anyone can. (Replaced domains with DOMAIN1 and DOMAIN2, and replaced API port with a generic example, for security.)

server {
    server_name DOMAIN2.com DOMAIN1.com;

    if ($host !~ ^((.*\.)?DOMAIN2\.com|ollama1\.DOMAIN1\.com)$) {
        return 404;
    }

    location /.well-known/ {
            root /var/www/html;
            try_files $uri $uri/ =404;
    }

    listen 443 ssl http2; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/DOMAIN1/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/DOMAIN1/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    # security
    add_header X-XSS-Protection          "1; mode=block" always;
    add_header X-Content-Type-Options    "nosniff" always;
    add_header Referrer-Policy           "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy   "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
    add_header Permissions-Policy        "interest-cohort=()" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    location / {
        proxy_pass http://127.0.0.1:8080;  # Forward to Docker app

        # Add WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Standard headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Timeouts for WebSocket connections
        proxy_read_timeout 60s;
        proxy_send_timeout 60s;
    }
}
server {
    listen 80 default_server;
    server_name DOMAIN2 DOMAIN1;

    if ($host !~ ^(DOMAIN2\.com|ollama1\.DOMAIN1\.com)$) {
        return 404;
    }
    if ($host = DOMAIN1) {
        return 301 https://$host$request_uri;
    }

    location /.well-known/ {
                root /var/www/html;
                try_files $uri $uri/ =404;
    }
    
    location / {
            proxy_pass http://127.0.0.1:8080;
    }
}
server {
    listen 80;
    server_name ollama2.DOMAIN2;

    if ($host !~ ^(ollama2\.DOMAIN2\.com)$) {
        return 404;
    }

    location / {
        proxy_pass http://ollama2.local:8080;
    }
}
server {
    server_name DOMAIN2 DOMAIN1;
    
    if ($host !~ ^((.*\.)?DOMAIN2\.com|ollama1\.DOMAIN1\.com)$) {
        return 404;
    }

    listen 12345 ssl http2; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/DOMAIN1/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/DOMAIN1/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    
    # security
    add_header X-XSS-Protection          "1; mode=block" always;
    add_header X-Content-Type-Options    "nosniff" always;
    add_header Referrer-Policy           "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy   "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
    add_header Permissions-Policy        "interest-cohort=()" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    location / {
        proxy_pass http://127.0.0.1:11434;  # Forward to Docker app

        # Add WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Standard headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Timeouts for WebSocket connections
        proxy_read_timeout 60s;
        proxy_send_timeout 60s;
    }
}

<!-- gh-comment-id:2567121374 --> @MattariOnline commented on GitHub (Jan 1, 2025): Also having this issue, but adding the various headers, http2, and even the portion commented as "security" didn't work (added them incrementally). Doesn't work from either of my two domains, nor through my CloudFlare connection. Only works with a LAN address. Desperate for help if anyone can. (Replaced domains with DOMAIN1 and DOMAIN2, and replaced API port with a generic example, for security.) ```nginx server { server_name DOMAIN2.com DOMAIN1.com; if ($host !~ ^((.*\.)?DOMAIN2\.com|ollama1\.DOMAIN1\.com)$) { return 404; } location /.well-known/ { root /var/www/html; try_files $uri $uri/ =404; } listen 443 ssl http2; # managed by Certbot ssl_certificate /etc/letsencrypt/live/DOMAIN1/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/DOMAIN1/privkey.pem; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot # security add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "no-referrer-when-downgrade" always; add_header Content-Security-Policy "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always; add_header Permissions-Policy "interest-cohort=()" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; location / { proxy_pass http://127.0.0.1:8080; # Forward to Docker app # Add WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; # Standard headers proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-Proto $scheme; # Timeouts for WebSocket connections proxy_read_timeout 60s; proxy_send_timeout 60s; } } server { listen 80 default_server; server_name DOMAIN2 DOMAIN1; if ($host !~ ^(DOMAIN2\.com|ollama1\.DOMAIN1\.com)$) { return 404; } if ($host = DOMAIN1) { return 301 https://$host$request_uri; } location /.well-known/ { root /var/www/html; try_files $uri $uri/ =404; } location / { proxy_pass http://127.0.0.1:8080; } } server { listen 80; server_name ollama2.DOMAIN2; if ($host !~ ^(ollama2\.DOMAIN2\.com)$) { return 404; } location / { proxy_pass http://ollama2.local:8080; } } server { server_name DOMAIN2 DOMAIN1; if ($host !~ ^((.*\.)?DOMAIN2\.com|ollama1\.DOMAIN1\.com)$) { return 404; } listen 12345 ssl http2; # managed by Certbot ssl_certificate /etc/letsencrypt/live/DOMAIN1/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/DOMAIN1/privkey.pem; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot # security add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "no-referrer-when-downgrade" always; add_header Content-Security-Policy "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always; add_header Permissions-Policy "interest-cohort=()" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; location / { proxy_pass http://127.0.0.1:11434; # Forward to Docker app # Add WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; # Standard headers proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-Proto $scheme; # Timeouts for WebSocket connections proxy_read_timeout 60s; proxy_send_timeout 60s; } } ```
Author
Owner

@MattariOnline commented on GitHub (Jan 1, 2025):

Alright as an update, I started looking into enabling HTTP/2 (in case it wasn't) using this guide: https://sslinsights.com/how-to-enable-http2-on-nginx-web-server/
Made changes to nginx.conf and now the first domain, cname to IP, is working, though I had to test with private browser.
Just gotta work on getting the CloudFlare one to work, which currently still fails.

Update:
Fixed the CloudFlare side as well. If you have CloudFlare pointing in and it doesn't work on the cloudflare side, but you have SSL and HTTP/2 working on your Nginx, you may want to ensure you have full SSL encryption mode enabled and not flexible.
Go manage your domain in CloudFlare, then go to SSL/TLS > Overview > SSL/TLS encryption > Configure.
Ensure the option is set to Full (unless you choose to install CloudFlare's cert or have a publicly trusted cert, in which case select the appropriate option), and Save.

<!-- gh-comment-id:2567146651 --> @MattariOnline commented on GitHub (Jan 1, 2025): Alright as an update, I started looking into enabling HTTP/2 (in case it wasn't) using this guide: https://sslinsights.com/how-to-enable-http2-on-nginx-web-server/ Made changes to nginx.conf and now the first domain, cname to IP, is working, though I had to test with private browser. Just gotta work on getting the CloudFlare one to work, which currently still fails. Update: Fixed the CloudFlare side as well. If you have CloudFlare pointing in and it doesn't work on the cloudflare side, but you have SSL and HTTP/2 working on your Nginx, you may want to ensure you have full SSL encryption mode enabled and not flexible. Go manage your domain in CloudFlare, then go to SSL/TLS > Overview > SSL/TLS encryption > Configure. Ensure the option is set to Full (unless you choose to install CloudFlare's cert or have a publicly trusted cert, in which case select the appropriate option), and Save.
Author
Owner

@T-Shilov commented on GitHub (Jan 1, 2025):

Can you tell me which reverse proxy is best suited for working with socks for the Open Web UI ?

  • 3proxy
  • HAProxy
  • Traefik
  • Caddy
  • Nginx

Upd. Lighttpd

<!-- gh-comment-id:2567172468 --> @T-Shilov commented on GitHub (Jan 1, 2025): Can you tell me which reverse proxy is best suited for working with socks for the Open Web UI ? - 3proxy - HAProxy - Traefik - Caddy - Nginx Upd. **Lighttpd**
Author
Owner

@danielj23 commented on GitHub (Jan 1, 2025):

@T-Shilov I don't know if there is a "best suited" because it can be situational based on someone's hardware and connection situation. If someone is using Caddy, or Traefik, etc., its very likely because they just like that product, not because its better or worse than another.

I use 'Nginx proxy manager' and my basic installation with no special config has worked (with cloudflare proxy included) since the first time I set it up. Since this .5 issue came up, simply enabling HTTP/2 in NPM config - has me back up and running just fine.

I use NPM for almost everything and I don't like Caddy. But that is just me.

<!-- gh-comment-id:2567183281 --> @danielj23 commented on GitHub (Jan 1, 2025): @T-Shilov I don't know if there is a "best suited" because it can be situational based on someone's hardware and connection situation. If someone is using Caddy, or Traefik, etc., its very likely because they just like that product, not because its better or worse than another. I use 'Nginx proxy manager' and my basic installation with no special config has worked (with cloudflare proxy included) since the first time I set it up. Since this .5 issue came up, simply enabling HTTP/2 in NPM config - has me back up and running just fine. I use NPM for almost everything and I don't like Caddy. But that is just me.
Author
Owner

@skarabaraks commented on GitHub (Jan 2, 2025):

I also experienced the "Network error" after updating my WebUI, but only when using the reverse proxy on my Synology NAS.

The issue was resolved by enabling websockets on the Synology DSM Reverse Proxy - surprisingly, default settings worked right away.

Thanks to Matthias' guide for making it easy: https://mlohr.com/websockets-for-synology-dsm/

<!-- gh-comment-id:2567649462 --> @skarabaraks commented on GitHub (Jan 2, 2025): I also experienced the "Network error" after updating my WebUI, but only when using the reverse proxy on my Synology NAS. The issue was resolved by enabling websockets on the Synology DSM Reverse Proxy - surprisingly, default settings worked right away. Thanks to Matthias' guide for making it easy: https://mlohr.com/websockets-for-synology-dsm/
Author
Owner

@T-Shilov commented on GitHub (Jan 2, 2025):

danielj23

If someone is using Caddy, or Traefik, etc., its very likely because they just like that product, not because its better or worse than another.

Taste preferences is, of course, an important argument :-)

But it seems to me that choosing a proxy server should not create problems in the future.
Nginx worked fine with Open Web UI versions 0.4x.
However, with versions 0.5x, o created an unexpected issue with web sockets, and it required an adjustment to the config file.

It's bad. Therefore, we need a proxy server that does not create problems in the future and does not depend on the version of the Open Web UI.

<!-- gh-comment-id:2567896878 --> @T-Shilov commented on GitHub (Jan 2, 2025): **danielj23** > If someone is using Caddy, or Traefik, etc., its very likely because they just like that product, not because its better or worse than another. Taste preferences is, of course, an important argument :-) But it seems to me that choosing a proxy server should not create problems in the future. Nginx worked fine with Open Web UI versions 0.4x. However, with versions 0.5x, o created an unexpected issue with web sockets, and it required an adjustment to the config file. It's bad. Therefore, we need a proxy server that does not create problems in the future and does not depend on the version of the Open Web UI.
Author
Owner

@thekryz commented on GitHub (Jan 2, 2025):

It's bad. Therefore, we need a proxy server that does not create problems in the future and does not depend on the version of the Open Web UI.

While I also have the issue with nginx, I disagree that the proxy server should be exchanged. We need a stable configuration for nginx. And of course it would be great to include at least a couple of the most used proxy servers in open-webui testing in the future.

<!-- gh-comment-id:2567903640 --> @thekryz commented on GitHub (Jan 2, 2025): > It's bad. Therefore, we need a proxy server that does not create problems in the future and does not depend on the version of the Open Web UI. While I also have the issue with nginx, I disagree that the proxy server should be exchanged. We need a stable configuration for nginx. And of course it would be great to include at least a couple of the most used proxy servers in open-webui testing in the future.
Author
Owner

@yoavain commented on GitHub (Jan 2, 2025):

I have the same issue with 0.5+ and only when using my external hostname. I use my NAS's reverse proxy. When using localhost it works. Works fine on 0.4.8.

Setup: Windows 11 Docker (running with --add-host=host.docker.internal:host-gateway)

Found the solution for Synology reverse-proxy (with the help of copilot)

image

<!-- gh-comment-id:2567972688 --> @yoavain commented on GitHub (Jan 2, 2025): > I have the same issue with 0.5+ and only when using my external hostname. I use my NAS's reverse proxy. When using `localhost` it works. Works fine on 0.4.8. > > Setup: Windows 11 Docker (running with `--add-host=host.docker.internal:host-gateway`) Found the solution for Synology reverse-proxy (with the help of copilot) ![image](https://github.com/user-attachments/assets/febaf9db-588d-4951-af23-b880d318cbc9)
Author
Owner

@rasodu commented on GitHub (Jan 2, 2025):

I am using Traefik v3. Does anyone know which config needs to be adjusted to make it work with OpenWebUI 5+? I tried Upgrading to OpenWebUI 5.2 but ended up downloading 4.8 because of the issue.

<!-- gh-comment-id:2568159682 --> @rasodu commented on GitHub (Jan 2, 2025): I am using Traefik v3. Does anyone know which config needs to be adjusted to make it work with OpenWebUI 5+? I tried Upgrading to OpenWebUI 5.2 but ended up downloading 4.8 because of the issue.
Author
Owner

@T-Shilov commented on GitHub (Jan 2, 2025):

Adding explicit use of web sockets to the Nginx config helped me:

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

<!-- gh-comment-id:2568212440 --> @T-Shilov commented on GitHub (Jan 2, 2025): Adding explicit use of web sockets to the Nginx config helped me: ``` # WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; ```
Author
Owner

@scottrbaxter commented on GitHub (Jan 2, 2025):

It seems that haproxy, at least the pfsense implementation, isn't playing nice with the networking changes in 0.5+

Until 0.5.3, i had to revert back to 0.4.8 just to have any reasonably quick responses. It was often so slow that ollama's 5 min timeout would end well before the response was finished writing to the open-webui session. Starting with 0.5.3, setting ENABLE_REALTIME_CHAT_SAVE=False will at least speed up the token response time very similarly to what it was prior to 0.5+, however, i still get a ton of these bad request messages, e.g.

POST /api/v1/tasks/auto/completions HTTP/1.1" 400 Bad Request

Note: Autocomplete Generation and Tags Generation are disabled in the Admin Panel, still trying to track down what causes this bad request.

i think this change around websockets could benefit from some additional documentation and guidelines for (at least) the most common reverse proxy solutions around. far as i can tell, haproxy should already have websocket support... so i'm not sure why i'd need to set ENABLE_REALTIME_CHAT_SAVE=False as is.. ideally would prefer not to require this, but it's not a problem if that must persist. for now, though, and since nginx seems to be covered pretty well above, could someone please chime in and thoroughly explain exactly what settings are necessary for users with haproxy?

<!-- gh-comment-id:2568333565 --> @scottrbaxter commented on GitHub (Jan 2, 2025): It seems that haproxy, at least the pfsense implementation, isn't playing nice with the networking changes in 0.5+ Until `0.5.3`, i had to revert back to `0.4.8` just to have any reasonably quick responses. It was often so slow that ollama's 5 min timeout would end well before the response was finished writing to the open-webui session. Starting with `0.5.3`, setting `ENABLE_REALTIME_CHAT_SAVE=False` will at least speed up the token response time very similarly to what it was prior to `0.5+`, however, i still get a ton of these bad request messages, e.g. `POST /api/v1/tasks/auto/completions HTTP/1.1" 400 Bad Request` Note: `Autocomplete Generation` and `Tags Generation` are disabled in the Admin Panel, still trying to track down what causes this bad request. i think this change around websockets could benefit from some additional documentation and guidelines for (at least) the most common reverse proxy solutions around. far as i can tell, [haproxy should already have websocket support](https://github.com/haproxy/haproxy/issues/162#issuecomment-1115415090)... so i'm not sure why i'd need to set `ENABLE_REALTIME_CHAT_SAVE=False` as is.. ideally would prefer not to require this, but it's not a problem if that must persist. for now, though, and since nginx seems to be covered pretty well above, could someone please chime in and thoroughly explain exactly what settings are necessary for users with haproxy?
Author
Owner

@tjbck commented on GitHub (Jan 2, 2025):

ENABLE_REALTIME_CHAT_SAVE will be set to False by default going forward with 0.5.4+

https://docs.openwebui.com/getting-started/advanced-topics/env-configuration#enable_realtime_chat_save

<!-- gh-comment-id:2568498315 --> @tjbck commented on GitHub (Jan 2, 2025): `ENABLE_REALTIME_CHAT_SAVE` will be set to `False` by default going forward with 0.5.4+ https://docs.openwebui.com/getting-started/advanced-topics/env-configuration#enable_realtime_chat_save
Author
Owner

@PiHiker commented on GitHub (Jan 4, 2025):

Adding explicit use of web sockets to the Nginx config helped me:

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

Confirmed working for me as well!

<!-- gh-comment-id:2571381318 --> @PiHiker commented on GitHub (Jan 4, 2025): > Adding explicit use of web sockets to the Nginx config helped me: > > ``` > # WebSocket support > proxy_http_version 1.1; > proxy_set_header Upgrade $http_upgrade; > proxy_set_header Connection "upgrade"; > ``` Confirmed working for me as well!
Author
Owner

@antraxbr666 commented on GitHub (Jan 5, 2025):

I use Nginx Reverse Proxy and i had the same problem (Network Problem) . So i solve enabling the WebSockets Support as image bellow:

nomoreproblem

<!-- gh-comment-id:2571740153 --> @antraxbr666 commented on GitHub (Jan 5, 2025): I use Nginx Reverse Proxy and i had the same problem (Network Problem) . So i solve enabling the WebSockets Support as image bellow: ![nomoreproblem](https://github.com/user-attachments/assets/a51040e3-826f-4551-bf9b-b040b5a3335d)
Author
Owner

@evilalmus commented on GitHub (Jan 6, 2025):

I use Nginx Reverse Proxy and i had the same problem (Network Problem) . So i solve enabling the WebSockets Support as image bellow:

I use Nginx Proxy Manager (which is what that screenshot is from) and enabling Websockets Support does NOT fix this issue for me.

<!-- gh-comment-id:2573727400 --> @evilalmus commented on GitHub (Jan 6, 2025): > I use Nginx Reverse Proxy and i had the same problem (Network Problem) . So i solve enabling the WebSockets Support as image bellow: I use Nginx Proxy Manager (which is what that screenshot is from) and enabling Websockets Support does NOT fix this issue for me.
Author
Owner

@danielj23 commented on GitHub (Jan 6, 2025):

I use Nginx Reverse Proxy and i had the same problem (Network Problem) . So i solve enabling the WebSockets Support as image bellow:

I use Nginx Proxy Manager (which is what that screenshot is from) and enabling Websockets Support does NOT fix this issue for me.

enable http/2 under SSL and see if that resolves it.

<!-- gh-comment-id:2573799336 --> @danielj23 commented on GitHub (Jan 6, 2025): > > I use Nginx Reverse Proxy and i had the same problem (Network Problem) . So i solve enabling the WebSockets Support as image bellow: > > I use Nginx Proxy Manager (which is what that screenshot is from) and enabling Websockets Support does NOT fix this issue for me. enable http/2 under SSL and see if that resolves it.
Author
Owner

@zeus123456 commented on GitHub (Jan 6, 2025):

To get mine to work with nginx, I had to add the websocket support as shown in the examples in this thread directly below location / proxy pass and not just anywhere nor at the bottom of your /etc/nginx/sites-available/your_conf_file_name.conf :

server {
server_name my_fqnd.com;
location / {
    proxy_pass http://my_private_IP:8080;

    # WebSocket support
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

__

Edit:
Had to rollback to open-webui:v0.4.8 as I was getting method not allowed error during call mode and 'session_id' errors in regular chats. (since everything works in 0.4.8 perhaps we can request nginx to be added as a feature in future versions?)

I tried updating nginx and allowing http/2, adding the websockets and some of the extras folks mentioned above, all without luck. I am thinking about trying to switch to nginx proxy manager next as that seems to show quite a bit of success for this issue.

I am running WSL ubuntu 22.04.5 and suspect my issue might be with my opnsense Firewall: NAT: Port Forward from my public IP to my private IP (enabling NAT reflection did not help either). I'd like to test on the private network, but call mode won't work without https.

Any ideas, things to look at, troubleshooting recommendations or suggestions from anyone?

<!-- gh-comment-id:2573827352 --> @zeus123456 commented on GitHub (Jan 6, 2025): To get mine to work with nginx, I had to add the websocket support as shown in the examples in this thread directly below location / proxy pass and not just anywhere nor at the bottom of your /etc/nginx/sites-available/your_conf_file_name.conf : server { server_name my_fqnd.com; location / { proxy_pass http://my_private_IP:8080; # WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; __ Edit: Had to rollback to open-webui:v0.4.8 as I was getting method not allowed error during call mode and 'session_id' errors in regular chats. (since everything works in 0.4.8 perhaps we can request nginx to be added as a feature in future versions?) I tried updating nginx and allowing http/2, adding the websockets and some of the extras folks mentioned above, all without luck. I am thinking about trying to switch to nginx proxy manager next as that seems to show quite a bit of success for this issue. I am running WSL ubuntu 22.04.5 and suspect my issue might be with my opnsense Firewall: NAT: Port Forward from my public IP to my private IP (enabling NAT reflection did not help either). I'd like to test on the private network, but call mode won't work without https. Any ideas, things to look at, troubleshooting recommendations or suggestions from anyone?
Author
Owner

@mophead64 commented on GitHub (Jan 6, 2025):

Adding explicit use of web sockets to the Nginx config helped me:

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

Confirmed working for me as well!

snap. I have a custom nginx container for reverse proxying http traffic, this did it also :)

<!-- gh-comment-id:2574042632 --> @mophead64 commented on GitHub (Jan 6, 2025): > > Adding explicit use of web sockets to the Nginx config helped me: > > ``` > > # WebSocket support > > proxy_http_version 1.1; > > proxy_set_header Upgrade $http_upgrade; > > proxy_set_header Connection "upgrade"; > > ``` > > Confirmed working for me as well! snap. I have a custom nginx container for reverse proxying http traffic, this did it also :)
Author
Owner

@universam1 commented on GitHub (Jan 7, 2025):

In our case the WS error connection rejected (400 Bad Request) was due to large request header, specifically caused by cookies in the request. Apparently the implementation has a limit.

We solved it by dropping the cookies on the /ws path, like this for Skipper Ingress.

  routes:
  - pathSubtree: /
  - pathSubtree: /ws
    filters:
    - dropRequestHeader("cookie")
<!-- gh-comment-id:2575007921 --> @universam1 commented on GitHub (Jan 7, 2025): In our case the WS error `connection rejected (400 Bad Request)` was due to large request header, specifically caused by cookies in the request. Apparently the implementation has a limit. We solved it by dropping the cookies on the `/ws` path, like this for Skipper Ingress. ``` routes: - pathSubtree: / - pathSubtree: /ws filters: - dropRequestHeader("cookie") ```
Author
Owner

@taoi11 commented on GitHub (Jan 8, 2025):

My work VPN causes use with web-socket traffic. this is present for other services and sites that use web sockets as well like perplexity.ai.
perhaps a back up communication method can be can be looked at....
personally I am okay without streaming outputs as a GPU poor user I often switch to other tabs during generation anyway.
I am using cloudfare tunnel to expose on my personal domain. Both tunnel and OpenWebUI are in containers
sorry I dont have more technical way to explain this issue.

<!-- gh-comment-id:2576519630 --> @taoi11 commented on GitHub (Jan 8, 2025): My work VPN causes use with web-socket traffic. this is present for other services and sites that use web sockets as well like perplexity.ai. perhaps a back up communication method can be can be looked at.... personally I am okay without streaming outputs as a GPU poor user I often switch to other tabs during generation anyway. I am using cloudfare tunnel to expose on my personal domain. Both tunnel and OpenWebUI are in containers sorry I dont have more technical way to explain this issue.
Author
Owner

@firestrife23 commented on GitHub (Jan 8, 2025):

It has served my family so well for a long time until now it's broken... I came here looking for a solution for Traefik.

<!-- gh-comment-id:2576752117 --> @firestrife23 commented on GitHub (Jan 8, 2025): It has served my family so well for a long time until now it's broken... I came here looking for a solution for Traefik.
Author
Owner

@gravgaard commented on GitHub (Jan 8, 2025):

I experience this issue on localhost.
All new agents a repsonded only once and then wrote 'Session Id' in.
From there it was unresponsive.
a ´docker restart´ for me fixed it, and i have not seen the problem for at least a dusin prompts now.

<!-- gh-comment-id:2576843479 --> @gravgaard commented on GitHub (Jan 8, 2025): I experience this issue on localhost. All new agents a repsonded only once and then wrote 'Session Id' in. From there it was unresponsive. a ´docker restart´ for me fixed it, and i have not seen the problem for at least a dusin prompts now.
Author
Owner

@Classic298 commented on GitHub (Jan 8, 2025):

I have the same issue with 400 errors. OpenWebUI works normally, but every second 400 errors show up in the logs.

Running on pip
Version 0.5.4 (didn't use the prior versions, last version I used was 0.4.8)

I already had websocket support all this time in my nginx (with exactly the same config as written in this thread many times).

I also added http2 and tried debugging the issue myself but it does seem like openwebui does not handle the requests properly and that's why I get 400 errors.

When I access it locally (not through nginx) using curl I get "Invalid Transport"

curl -i http://127.0.0.1:8080/ws/socket.io/?EIO=4&transport=websocket

Or

curl -i http://127.0.0.1:8080/ws/socket.io/?EIO=4&transport=polling&t=PH5ESUI

Both return 400 Bad Request and Invalid transport

<!-- gh-comment-id:2577271033 --> @Classic298 commented on GitHub (Jan 8, 2025): I have the same issue with 400 errors. OpenWebUI works normally, but every second 400 errors show up in the logs. Running on pip Version 0.5.4 (didn't use the prior versions, last version I used was 0.4.8) I already had websocket support all this time in my nginx (with exactly the same config as written in this thread many times). I also added http2 and tried debugging the issue myself but it does seem like openwebui does not handle the requests properly and that's why I get 400 errors. When I access it locally (not through nginx) using curl I get "Invalid Transport" curl -i http://127.0.0.1:8080/ws/socket.io/?EIO=4&transport=websocket Or curl -i http://127.0.0.1:8080/ws/socket.io/?EIO=4&transport=polling&t=PH5ESUI Both return 400 Bad Request and Invalid transport
Author
Owner

@nyawox commented on GitHub (Jan 8, 2025):

i'm in a weird situation. iOS safari, pwa work just fine without any "sessionid" errors. but neither Firefox nor Chromium work on my linux desktop. always the Network Problem and Firefox can’t establish a connection to the server at wss://<redacted>/ws/socket.io/?EIO=4&transport=websocket. websocket.js:43:26 error. i'm certain websocket always has been working (should be ootb when using caddy) on my setup, and i can easily confirm that with bitwarden extension.

<!-- gh-comment-id:2577623293 --> @nyawox commented on GitHub (Jan 8, 2025): i'm in a weird situation. iOS safari, pwa work just fine without any "sessionid" errors. but neither Firefox nor Chromium work on my linux desktop. always the Network Problem and `Firefox can’t establish a connection to the server at wss://<redacted>/ws/socket.io/?EIO=4&transport=websocket. websocket.js:43:26` error. i'm certain websocket always has been working (should be ootb when using caddy) on my setup, and i can easily confirm that with bitwarden extension.
Author
Owner

@wk222 commented on GitHub (Jan 8, 2025):

I'm using the following Nginx configuration file, and while I can access my website without errors, the response time seems slower compared to accessing it directly via the IP address

`
server_name

location / {
    proxy_pass http://localhost;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    proxy_read_timeout 60s;
    proxy_send_timeout 60s;
    proxy_connect_timeout 60s;
}

}`

To get mine to work with nginx, I had to add the websocket support as shown in the examples in this thread directly below location / proxy pass and not just anywhere nor at the bottom of your /etc/nginx/sites-available/your_conf_file_name.conf :

server {
server_name my_fqnd.com;
location / {
    proxy_pass http://my_private_IP:8080;

    # WebSocket support
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

__

Edit: Had to rollback to open-webui:v0.4.8 as I was getting method not allowed error during call mode and 'session_id' errors in regular chats. (since everything works in 0.4.8 perhaps we can request nginx to be added as a feature in future versions?)

I tried updating nginx and allowing http/2, adding the websockets and some of the extras folks mentioned above, all without luck. I am thinking about trying to switch to nginx proxy manager next as that seems to show quite a bit of success for this issue.

I am running WSL ubuntu 22.04.5 and suspect my issue might be with my opnsense Firewall: NAT: Port Forward from my public IP to my private IP (enabling NAT reflection did not help either). I'd like to test on the private network, but call mode won't work without https.

Any ideas, things to look at, troubleshooting recommendations or suggestions from anyone?

<!-- gh-comment-id:2577647412 --> @wk222 commented on GitHub (Jan 8, 2025): I'm using the following Nginx configuration file, and while I can access my website without errors, the response time seems slower compared to accessing it directly via the IP address ` server_name location / { proxy_pass http://localhost; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_read_timeout 60s; proxy_send_timeout 60s; proxy_connect_timeout 60s; } }` > To get mine to work with nginx, I had to add the websocket support as shown in the examples in this thread directly below location / proxy pass and not just anywhere nor at the bottom of your /etc/nginx/sites-available/your_conf_file_name.conf : > > ``` > server { > server_name my_fqnd.com; > location / { > proxy_pass http://my_private_IP:8080; > > # WebSocket support > proxy_http_version 1.1; > proxy_set_header Upgrade $http_upgrade; > proxy_set_header Connection "upgrade"; > > proxy_set_header Host $host; > proxy_set_header X-Real-IP $remote_addr; > proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; > proxy_set_header X-Forwarded-Proto $scheme; > ``` > > __ > > Edit: Had to rollback to open-webui:v0.4.8 as I was getting method not allowed error during call mode and 'session_id' errors in regular chats. (since everything works in 0.4.8 perhaps we can request nginx to be added as a feature in future versions?) > > I tried updating nginx and allowing http/2, adding the websockets and some of the extras folks mentioned above, all without luck. I am thinking about trying to switch to nginx proxy manager next as that seems to show quite a bit of success for this issue. > > I am running WSL ubuntu 22.04.5 and suspect my issue might be with my opnsense Firewall: NAT: Port Forward from my public IP to my private IP (enabling NAT reflection did not help either). I'd like to test on the private network, but call mode won't work without https. > > Any ideas, things to look at, troubleshooting recommendations or suggestions from anyone?
Author
Owner

@Classic298 commented on GitHub (Jan 8, 2025):

I have the same issue with 400 errors. OpenWebUI works normally, but every second 400 errors show up in the logs.

Running on pip Version 0.5.4 (didn't use the prior versions, last version I used was 0.4.8)

I already had websocket support all this time in my nginx (with exactly the same config as written in this thread many times).

I also added http2 and tried debugging the issue myself but it does seem like openwebui does not handle the requests properly and that's why I get 400 errors.

When I access it locally (not through nginx) using curl I get "Invalid Transport"

curl -i http://127.0.0.1:8080/ws/socket.io/?EIO=4&transport=websocket

Or

curl -i http://127.0.0.1:8080/ws/socket.io/?EIO=4&transport=polling&t=PH5ESUI

Both return 400 Bad Request and Invalid transport

Update to my issue, sometimes a weird red error 'session-id' pops up at the top of openwebui and renders it totally unusable

Only bypass is logging out and logging back in multiple times and deleting browser cache and cookies and then it works again for the most part.

So something is not working 100%... Hmm

<!-- gh-comment-id:2577756678 --> @Classic298 commented on GitHub (Jan 8, 2025): > I have the same issue with 400 errors. OpenWebUI works normally, but every second 400 errors show up in the logs. > > Running on pip Version 0.5.4 (didn't use the prior versions, last version I used was 0.4.8) > > I already had websocket support all this time in my nginx (with exactly the same config as written in this thread many times). > > I also added http2 and tried debugging the issue myself but it does seem like openwebui does not handle the requests properly and that's why I get 400 errors. > > When I access it locally (not through nginx) using curl I get "Invalid Transport" > > curl -i http://127.0.0.1:8080/ws/socket.io/?EIO=4&transport=websocket > > Or > > curl -i http://127.0.0.1:8080/ws/socket.io/?EIO=4&transport=polling&t=PH5ESUI > > Both return 400 Bad Request and Invalid transport Update to my issue, sometimes a weird red error 'session-id' pops up at the top of openwebui and renders it totally unusable Only bypass is logging out and logging back in multiple times and deleting browser cache and cookies and then it works again for the most part. So something is not working 100%... Hmm
Author
Owner

@JingbiaoMei commented on GitHub (Jan 8, 2025):

If you are using npm, the simplest way is to enable websockets supports.
image

<!-- gh-comment-id:2578145994 --> @JingbiaoMei commented on GitHub (Jan 8, 2025): If you are using npm, the simplest way is to enable websockets supports. ![image](https://github.com/user-attachments/assets/c366165a-1a66-4d30-95ce-05e431601328)
Author
Owner

@Classic298 commented on GitHub (Jan 8, 2025):

If you are using npm, the simplest way is to enable websockets supports.

Who did you talk to (or who did you mean to reply to)?
For me: I use pip.

<!-- gh-comment-id:2578150116 --> @Classic298 commented on GitHub (Jan 8, 2025): > If you are using npm, the simplest way is to enable websockets supports. Who did you talk to (or who did you mean to reply to)? For me: I use pip.
Author
Owner

@danielj23 commented on GitHub (Jan 8, 2025):

@Classic298 I honestly don't think your issue is in any way related to this topic.

<!-- gh-comment-id:2578180701 --> @danielj23 commented on GitHub (Jan 8, 2025): @Classic298 I honestly don't think your issue is in any way related to this topic.
Author
Owner

@Classic298 commented on GitHub (Jan 8, 2025):

@danielj23 from my understanding, and I read the entire thread, it fits perfectly into it.

I get the weird session-id errors in the UI and the exact 400 error messages show up in the logs repeatedly as many have reported here.

Both these things, the users in this thread have discussed this entire time, so why would it not fit to this issue?

<!-- gh-comment-id:2578226723 --> @Classic298 commented on GitHub (Jan 8, 2025): @danielj23 from my understanding, and I read the entire thread, it fits perfectly into it. I get the weird session-id errors in the UI and the exact 400 error messages show up in the logs repeatedly as many have reported here. Both these things, the users in this thread have discussed this entire time, so why would it not fit to this issue?
Author
Owner

@wainage commented on GitHub (Jan 8, 2025):

For anyone using OrbStack instead of Docker, visit https://open-webui.orb.local instead of localhost (or find your specific DNS domain name in the container info section).

Chromium browsers have issues upgrading secure web sockets from http. Firefox seems to have no beef and works fine on http://localhost:3000.

If you are having issues with OrbStack DNS, check the following:

  • Settings -> Network -> Allow access to container domains & IPs
  • Settings -> Network -> Enable HTTPS for container domains

and make sure they are both selected. You should be able to access it on https://<container-name>.orb.local without the port.

<!-- gh-comment-id:2578235369 --> @wainage commented on GitHub (Jan 8, 2025): For anyone using OrbStack instead of Docker, visit https://open-webui.orb.local instead of localhost (or find your specific DNS domain name in the container info section). Chromium browsers have issues upgrading secure web sockets from http. Firefox seems to have no beef and works fine on http://localhost:3000. If you are having issues with OrbStack DNS, check the following: - **Settings** -> **Network** -> **Allow access to container domains & IPs** - **Settings** -> **Network** -> **Enable HTTPS for container domains** and make sure they are both selected. You should be able to access it on https://\<container-name\>.orb.local **without** the port.
Author
Owner

@feuler commented on GitHub (Jan 9, 2025):

I have the same issue with Traefik v3 (versions tried: 3.2.3 & 3.3.1) when using openwebui functions. I tried to add a middleware with "X-Forwarded-Proto=https", but it didn't solve the problem.
Generally websocket connection is working when i test it e.g. via curl.

My current traefik config for the openwebui docker container (via labels)
labels:
- "traefik.enable=true"
- "traefik.http.routers.openwebui.rule=Host(mydomain.example.com)"
- "traefik.http.routers.openwebui.entrypoints=websecure"
- "traefik.http.routers.openwebui.tls=true"
- "traefik.http.services.openwebui.loadbalancer.server.port=8080"
- "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
- "traefik.http.routers.openwebui.middlewares=sslheader"

<!-- gh-comment-id:2579913862 --> @feuler commented on GitHub (Jan 9, 2025): I have the same issue with Traefik v3 (versions tried: 3.2.3 & 3.3.1) when using openwebui functions. I tried to add a middleware with "X-Forwarded-Proto=https", but it didn't solve the problem. Generally websocket connection is working when i test it e.g. via curl. My current traefik config for the openwebui docker container (via labels) labels: - "traefik.enable=true" - "traefik.http.routers.openwebui.rule=Host(`mydomain.example.com`)" - "traefik.http.routers.openwebui.entrypoints=websecure" - "traefik.http.routers.openwebui.tls=true" - "traefik.http.services.openwebui.loadbalancer.server.port=8080" - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https" - "traefik.http.routers.openwebui.middlewares=sslheader"
Author
Owner

@firestrife23 commented on GitHub (Jan 9, 2025):

Your configuration is similar to mine, I guess I'm not the only one either.

<!-- gh-comment-id:2580457714 --> @firestrife23 commented on GitHub (Jan 9, 2025): Your configuration is similar to mine, I guess I'm not the only one either.
Author
Owner

@nwhobart commented on GitHub (Jan 9, 2025):

Has anyone resolved this issue for running on k8s?

  • installed via helm
  • using nginx-ingress as default ingress
  • trying to use a server-snippets and add:
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
    
  • manually set ENABLE_REALTIME_CHAT_SAVE to false

still can't get past the "Network Problem" message on every chat.

this app is dead in the water to me at the moment and I frustrated this issue isn't better documented for all common use cases.

<!-- gh-comment-id:2580866380 --> @nwhobart commented on GitHub (Jan 9, 2025): Has anyone resolved this issue for running on k8s? - installed via helm - using nginx-ingress as default ingress - trying to use a `server-snippets` and add: ``` proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; ``` - manually set `ENABLE_REALTIME_CHAT_SAVE` to `false` still can't get past the "Network Problem" message on every chat. this app is dead in the water to me at the moment and I frustrated this issue isn't better documented for all common use cases.
Author
Owner

@kim-gtek commented on GitHub (Jan 9, 2025):

@tjbck

Polling error

INFO: "GET /ws/socket.io/?EIO=4&transport=polling&t=PHC5cDm HTTP/1.1" 400 Bad Request

The error is being thrown by the following middleware.
The docker container is correctly receiving the WebSocket connection, but the following code is denying it due to the headers sent out.

@app.middleware("http")
async def inspect_websocket(request: Request, call_next):
    if (
        "/ws/socket.io" in request.url.path
        and request.query_params.get("transport") == "websocket"
    ):
        upgrade = (request.headers.get("Upgrade") or "").lower()
        connection = (request.headers.get("Connection") or "").lower().split(",")
        # Check that there's the correct headers for an upgrade, else reject the connection
        # This is to work around this upstream issue: https://github.com/miguelgrinberg/python-engineio/issues/367
        if upgrade != "websocket" or "upgrade" not in connection:
            return JSONResponse(
                status_code=status.HTTP_400_BAD_REQUEST,
                content={"detail": "Invalid WebSocket upgrade request"},
            )
    return await call_next(request)

layout.svelte

I believe this is the client side that sets up the connection.


const setupSocket = async (enableWebsocket) => {
	const _socket = io(`${WEBUI_BASE_URL}` || undefined, {
		reconnection: true,
		reconnectionDelay: 1000,
		reconnectionDelayMax: 5000,
		randomizationFactor: 0.5,
		path: '/ws/socket.io',
		transports: enableWebsocket ? ['websocket'] : ['polling', 'websocket'],
		auth: { token: localStorage.token }
	});
<!-- gh-comment-id:2580869124 --> @kim-gtek commented on GitHub (Jan 9, 2025): @tjbck ### Polling error `INFO: "GET /ws/socket.io/?EIO=4&transport=polling&t=PHC5cDm HTTP/1.1" 400 Bad Request ` The error is being thrown by the following middleware. The docker container is correctly receiving the WebSocket connection, but the following code is denying it due to the headers sent out. ``` @app.middleware("http") async def inspect_websocket(request: Request, call_next): if ( "/ws/socket.io" in request.url.path and request.query_params.get("transport") == "websocket" ): upgrade = (request.headers.get("Upgrade") or "").lower() connection = (request.headers.get("Connection") or "").lower().split(",") # Check that there's the correct headers for an upgrade, else reject the connection # This is to work around this upstream issue: https://github.com/miguelgrinberg/python-engineio/issues/367 if upgrade != "websocket" or "upgrade" not in connection: return JSONResponse( status_code=status.HTTP_400_BAD_REQUEST, content={"detail": "Invalid WebSocket upgrade request"}, ) return await call_next(request) ``` layout.svelte I believe this is the client side that sets up the connection. ``` const setupSocket = async (enableWebsocket) => { const _socket = io(`${WEBUI_BASE_URL}` || undefined, { reconnection: true, reconnectionDelay: 1000, reconnectionDelayMax: 5000, randomizationFactor: 0.5, path: '/ws/socket.io', transports: enableWebsocket ? ['websocket'] : ['polling', 'websocket'], auth: { token: localStorage.token } }); ```
Author
Owner

@nwhobart commented on GitHub (Jan 9, 2025):

ENABLE_REALTIME_CHAT_SAVE will be set to False by default going forward with 0.5.4+

https://docs.openwebui.com/getting-started/advanced-topics/env-configuration#enable_realtime_chat_save

this makes no difference in my case.

<!-- gh-comment-id:2581000692 --> @nwhobart commented on GitHub (Jan 9, 2025): > `ENABLE_REALTIME_CHAT_SAVE` will be set to `False` by default going forward with 0.5.4+ > > https://docs.openwebui.com/getting-started/advanced-topics/env-configuration#enable_realtime_chat_save this makes no difference in my case.
Author
Owner

@feuler commented on GitHub (Jan 9, 2025):

@tjbck

Polling error

INFO: "GET /ws/socket.io/?EIO=4&transport=polling&t=PHC5cDm HTTP/1.1" 400 Bad Request

The error is being thrown by the following middleware. The docker container is correctly receiving the WebSocket connection, but the following code is denying it due to the headers sent out.

@app.middleware("http")
async def inspect_websocket(request: Request, call_next):
    if (
        "/ws/socket.io" in request.url.path
        and request.query_params.get("transport") == "websocket"
    ):
        upgrade = (request.headers.get("Upgrade") or "").lower()
        connection = (request.headers.get("Connection") or "").lower().split(",")
        # Check that there's the correct headers for an upgrade, else reject the connection
        # This is to work around this upstream issue: https://github.com/miguelgrinberg/python-engineio/issues/367
        if upgrade != "websocket" or "upgrade" not in connection:
            return JSONResponse(
                status_code=status.HTTP_400_BAD_REQUEST,
                content={"detail": "Invalid WebSocket upgrade request"},
            )
    return await call_next(request)

layout.svelte

I believe this is the client side that sets up the connection.


const setupSocket = async (enableWebsocket) => {
	const _socket = io(`${WEBUI_BASE_URL}` || undefined, {
		reconnection: true,
		reconnectionDelay: 1000,
		reconnectionDelayMax: 5000,
		randomizationFactor: 0.5,
		path: '/ws/socket.io',
		transports: enableWebsocket ? ['websocket'] : ['polling', 'websocket'],
		auth: { token: localStorage.token }
	});

Thanks for the effort ! You think setting fixed request headers with Traefik labels could solve the issue ? Like:

labels:
  - "traefik.http.middlewares.ssl-header.headers.customrequestheaders.Connection=keep-alive, Upgrade"
  - "traefik.http.middlewares.ssl-header.headers.customrequestheaders.Upgrade=websocket"
  - "traefik.http.routers.openwebui.middlewares=ssl-header"

But, according from what i've read the "Upgrade: websocket" should normally be initiated from the client/browser side, right ?

<!-- gh-comment-id:2581030675 --> @feuler commented on GitHub (Jan 9, 2025): > @tjbck > > ### Polling error > `INFO: "GET /ws/socket.io/?EIO=4&transport=polling&t=PHC5cDm HTTP/1.1" 400 Bad Request ` > > The error is being thrown by the following middleware. The docker container is correctly receiving the WebSocket connection, but the following code is denying it due to the headers sent out. > > ``` > @app.middleware("http") > async def inspect_websocket(request: Request, call_next): > if ( > "/ws/socket.io" in request.url.path > and request.query_params.get("transport") == "websocket" > ): > upgrade = (request.headers.get("Upgrade") or "").lower() > connection = (request.headers.get("Connection") or "").lower().split(",") > # Check that there's the correct headers for an upgrade, else reject the connection > # This is to work around this upstream issue: https://github.com/miguelgrinberg/python-engineio/issues/367 > if upgrade != "websocket" or "upgrade" not in connection: > return JSONResponse( > status_code=status.HTTP_400_BAD_REQUEST, > content={"detail": "Invalid WebSocket upgrade request"}, > ) > return await call_next(request) > ``` > > layout.svelte > > I believe this is the client side that sets up the connection. > > ``` > > const setupSocket = async (enableWebsocket) => { > const _socket = io(`${WEBUI_BASE_URL}` || undefined, { > reconnection: true, > reconnectionDelay: 1000, > reconnectionDelayMax: 5000, > randomizationFactor: 0.5, > path: '/ws/socket.io', > transports: enableWebsocket ? ['websocket'] : ['polling', 'websocket'], > auth: { token: localStorage.token } > }); > ``` Thanks for the effort ! You think setting fixed request headers with Traefik labels could solve the issue ? Like: labels: - "traefik.http.middlewares.ssl-header.headers.customrequestheaders.Connection=keep-alive, Upgrade" - "traefik.http.middlewares.ssl-header.headers.customrequestheaders.Upgrade=websocket" - "traefik.http.routers.openwebui.middlewares=ssl-header" But, according from what i've read the "Upgrade: websocket" should normally be initiated from the client/browser side, right ?
Author
Owner

@kim-gtek commented on GitHub (Jan 9, 2025):

I am unsure, I spent a few hours today digging to find the source of the error, but I have not looked at any solutions yet as I have never dealt with web sockets before.

If I have time tomorrow I will look into that, it could work!

<!-- gh-comment-id:2581043013 --> @kim-gtek commented on GitHub (Jan 9, 2025): I am unsure, I spent a few hours today digging to find the source of the error, but I have not looked at any solutions yet as I have never dealt with web sockets before. If I have time tomorrow I will look into that, it could work!
Author
Owner

@feuler commented on GitHub (Jan 9, 2025):

I am unsure, I spent a few hours today digging to find the source of the error, but I have not looked at any solutions yet as I have never dealt with web sockets before.

If I have time tomorrow I will look into that, it could work!

I just tried the labels and unfortunately they didn't fix the problem. Also the "Upgrade=websocket" header produced a "Missing Sec-WebSocket-Key" error.

<!-- gh-comment-id:2581121257 --> @feuler commented on GitHub (Jan 9, 2025): > I am unsure, I spent a few hours today digging to find the source of the error, but I have not looked at any solutions yet as I have never dealt with web sockets before. > > If I have time tomorrow I will look into that, it could work! I just tried the labels and unfortunately they didn't fix the problem. Also the "Upgrade=websocket" header produced a "Missing Sec-WebSocket-Key" error.
Author
Owner

@zeus123456 commented on GitHub (Jan 9, 2025):

Related: #8073

As mentioned in the changelogs, you need a proper websocket support going forward with 0.5.0+

I'll make a educated guess here and say you have a network misconfiguration (most likely your reverse proxy) that's blocking the webui from properly communicating with the backend. You'll notice without the reverse proxy, the webui will work as intended (let me know if this is not the case for you). The recommended course of action would be to ask questions directly in the respective reverse proxy community.

Keep us updated with your troubleshooting journey!

Update

If you directly access the webui via localhost, you should not encounter this issue.

__

How tough would it be for a feature to be added for the ability to toggle websockets required on or off?
Then folks could enable/disable to help test/troubleshoot, but still be on a newer version.
As accessing via localhost is not what users using a reverse proxy are looking for.

Another suggestion is to add nginx and potentially other reverse proxies as a feature, similar to how we can choose for images:
Automatic1111
CumfyUI

<!-- gh-comment-id:2581355260 --> @zeus123456 commented on GitHub (Jan 9, 2025): > Related: #8073 > > As mentioned in the changelogs, you need a proper websocket support going forward with 0.5.0+ > > I'll make a educated guess here and say you have a network misconfiguration (most likely your reverse proxy) that's blocking the webui from properly communicating with the backend. You'll notice **without the reverse proxy,** the webui **will work** as intended (let me know if this is not the case for you). The recommended course of action would be to ask questions directly in the respective reverse proxy community. > > Keep us updated with your troubleshooting journey! > > # Update > If you directly access the webui via localhost, you should not encounter this issue. __ How tough would it be for a feature to be added for the ability to toggle websockets required on or off? Then folks could enable/disable to help test/troubleshoot, but still be on a newer version. As accessing via localhost is not what users using a reverse proxy are looking for. Another suggestion is to add nginx and potentially other reverse proxies as a feature, similar to how we can choose for images: Automatic1111 CumfyUI
Author
Owner

@feuler commented on GitHub (Jan 10, 2025):

Related: #8073
As mentioned in the changelogs, you need a proper websocket support going forward with 0.5.0+
I'll make a educated guess here and say you have a network misconfiguration (most likely your reverse proxy) that's blocking the webui from properly communicating with the backend. You'll notice without the reverse proxy, the webui will work as intended (let me know if this is not the case for you). The recommended course of action would be to ask questions directly in the respective reverse proxy community.
Keep us updated with your troubleshooting journey!

Update

If you directly access the webui via localhost, you should not encounter this issue.

__

How tough would it be for a feature to be added for the ability to toggle websockets required on or off? Then folks could enable/disable to help test/troubleshoot, but still be on a newer version. As accessing via localhost is not what users using a reverse proxy are looking for.

Another suggestion is to add nginx and potentially other reverse proxies as a feature, similar to how we can choose for images: Automatic1111 CumfyUI

I saw that there was an env option "ENABLE_WEBSOCKET_SUPPORT=true/false" added here https://github.com/open-webui/open-webui/pull/5270/files
I tried both true and false, but it didn't solve the problem.

<!-- gh-comment-id:2581682002 --> @feuler commented on GitHub (Jan 10, 2025): > > Related: #8073 > > As mentioned in the changelogs, you need a proper websocket support going forward with 0.5.0+ > > I'll make a educated guess here and say you have a network misconfiguration (most likely your reverse proxy) that's blocking the webui from properly communicating with the backend. You'll notice **without the reverse proxy,** the webui **will work** as intended (let me know if this is not the case for you). The recommended course of action would be to ask questions directly in the respective reverse proxy community. > > Keep us updated with your troubleshooting journey! > > # Update > > If you directly access the webui via localhost, you should not encounter this issue. > > __ > > How tough would it be for a feature to be added for the ability to toggle websockets required on or off? Then folks could enable/disable to help test/troubleshoot, but still be on a newer version. As accessing via localhost is not what users using a reverse proxy are looking for. > > Another suggestion is to add nginx and potentially other reverse proxies as a feature, similar to how we can choose for images: Automatic1111 CumfyUI I saw that there was an env option "ENABLE_WEBSOCKET_SUPPORT=true/false" added here https://github.com/open-webui/open-webui/pull/5270/files I tried both true and false, but it didn't solve the problem.
Author
Owner

@kim-gtek commented on GitHub (Jan 10, 2025):

It was a caching problem.
I disabled cache in google chrome dev tools networking tab - reloaded, and no more errors.

<!-- gh-comment-id:2582691300 --> @kim-gtek commented on GitHub (Jan 10, 2025): It was a caching problem. I disabled cache in google chrome dev tools networking tab - reloaded, and no more errors.
Author
Owner

@dh1tw commented on GitHub (Jan 10, 2025):

setting the environment variable ENABLE_WEBSOCKET_SUPPORT=0 disables websockets.

<!-- gh-comment-id:2582967570 --> @dh1tw commented on GitHub (Jan 10, 2025): setting the environment variable ENABLE_WEBSOCKET_SUPPORT=0 disables websockets.
Author
Owner

@aquananu commented on GitHub (Jan 10, 2025):

i solved same using below config on NGINX
server {
listen 80;
server_name llm.DOMAIN.com; # change it your domain name

# Redirect all HTTP traffic to HTTPS
return 307 https://llm.DOMAIN.com$request_uri; # change it your domain name

}

server {
listen 443 ssl http2;
server_name llm.DOMAIN.com; # change it your domain name

# SSL configuration
ssl_certificate /etc/letsencrypt/live/llm.DOMAIN.com/fullchain.pem; # change it your domain name
ssl_certificate_key /etc/letsencrypt/live/llm.DOMAIN.com/privkey.pem; # change it your domain name
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!MD5;
ssl_prefer_server_ciphers on;

# Logging
access_log /var/log/nginx/llm.access.log;

# Security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header Referrer-Policy no-referrer-when-downgrade;

location / {
    # Proxy settings
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # Use HTTP/1.1 for proxying
    proxy_http_version 1.1;

    # Pass traffic to the router
    proxy_pass http://192.168.1.2:8080; # Use YOUR IP
    proxy_read_timeout 90s;
    proxy_redirect off;

    # Client upload size - change this as per your requirment
    client_max_body_size 100M;
}

}

Hope this will be helpful for people

<!-- gh-comment-id:2583806338 --> @aquananu commented on GitHub (Jan 10, 2025): i solved same using below config on NGINX server { listen 80; server_name llm.DOMAIN.com; # change it your domain name # Redirect all HTTP traffic to HTTPS return 307 https://llm.DOMAIN.com$request_uri; # change it your domain name } server { listen 443 ssl http2; server_name llm.DOMAIN.com; # change it your domain name # SSL configuration ssl_certificate /etc/letsencrypt/live/llm.DOMAIN.com/fullchain.pem; # change it your domain name ssl_certificate_key /etc/letsencrypt/live/llm.DOMAIN.com/privkey.pem; # change it your domain name ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:!MD5; ssl_prefer_server_ciphers on; # Logging access_log /var/log/nginx/llm.access.log; # Security headers add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; add_header X-Frame-Options SAMEORIGIN; add_header X-Content-Type-Options nosniff; add_header Referrer-Policy no-referrer-when-downgrade; location / { # Proxy settings proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # Use HTTP/1.1 for proxying proxy_http_version 1.1; # Pass traffic to the router proxy_pass http://192.168.1.2:8080; # Use YOUR IP proxy_read_timeout 90s; proxy_redirect off; # Client upload size - change this as per your requirment client_max_body_size 100M; } } Hope this will be helpful for people
Author
Owner

@nwhobart commented on GitHub (Jan 10, 2025):

setting the environment variable ENABLE_WEBSOCKET_SUPPORT=0 disables websockets.

THANK YOU!

<!-- gh-comment-id:2584286668 --> @nwhobart commented on GitHub (Jan 10, 2025): > setting the environment variable ENABLE_WEBSOCKET_SUPPORT=0 disables websockets. THANK YOU!
Author
Owner

@zeus123456 commented on GitHub (Jan 11, 2025):

After trying many of the recommendations from above, I finally got it working by disabling nginx and deploying the Nginx Proxy Manager container by just following the Quick Setup from https://nginxproxymanager.com/guide/ .

Via a nice gui menu I just added a proxy host and put under Domain Names my public fqdn, for scheme selected http, forward hostname/ip is my open webui private IP, port 8080, enable websockets toggle, then went to the ssl tab and added ssl cert for let's encrypt with my fqdn and it got a new cert and everything works perfectly now via https externally :).

It would be nice to know what the Nginx Proxy Manager conf is so I could know what was wrong with my previous config trying to add websocket,

__

I just uncommented these 2 lines in the docker-compose.yaml:

DB_SQLITE_FILE: "/data/database.sqlite"
DISABLE_IPV6: 'true'
__

sudo docker-compose up -d

<!-- gh-comment-id:2585074788 --> @zeus123456 commented on GitHub (Jan 11, 2025): After trying many of the recommendations from above, I finally got it working by disabling nginx and deploying the Nginx Proxy Manager container by just following the Quick Setup from https://nginxproxymanager.com/guide/ . Via a nice gui menu I just added a proxy host and put under Domain Names my public fqdn, for scheme selected http, forward hostname/ip is my open webui private IP, port 8080, enable websockets toggle, then went to the ssl tab and added ssl cert for let's encrypt with my fqdn and it got a new cert and everything works perfectly now via https externally :). It would be nice to know what the Nginx Proxy Manager conf is so I could know what was wrong with my previous config trying to add websocket, __ I just uncommented these 2 lines in the docker-compose.yaml: DB_SQLITE_FILE: "/data/database.sqlite" DISABLE_IPV6: 'true' __ sudo docker-compose up -d
Author
Owner

@loglux commented on GitHub (Jan 12, 2025):

Rolled back to v0.5.3 after finding v0.5.4 unusable.

The Network error, freezing, and constant disconnections from Ollama made it impossible to use. If you're on v0.5.4, consider rolling back using:

ghcr.io/open-webui/open-webui:v0.5.3
<!-- gh-comment-id:2585595338 --> @loglux commented on GitHub (Jan 12, 2025): ### Rolled back to v0.5.3 after finding v0.5.4 unusable. The `Network error`, freezing, and constant disconnections from Ollama made it impossible to use. If you're on v0.5.4, consider rolling back using: ```bash ghcr.io/open-webui/open-webui:v0.5.3 ```
Author
Owner

@tjbck commented on GitHub (Jan 12, 2025):

@loglux Please avoid spamming and make use of the edit feature when necessary. Excessive posting goes against the code of conduct and could lead to a ban. Keep in mind that this thread has many participants—thank you for understanding!

<!-- gh-comment-id:2585632545 --> @tjbck commented on GitHub (Jan 12, 2025): @loglux Please avoid spamming and make use of the edit feature when necessary. Excessive posting goes against the code of conduct and could lead to a ban. Keep in mind that this thread has many participants—thank you for understanding!
Author
Owner

@ayyazzafar commented on GitHub (Jan 12, 2025):

Facing same issue. I am rolling back to previous version

<!-- gh-comment-id:2585739461 --> @ayyazzafar commented on GitHub (Jan 12, 2025): Facing same issue. I am rolling back to previous version
Author
Owner

@loglux commented on GitHub (Jan 12, 2025):

I found that the previous version still has the same problem. After encountering a 'Network error,' it's necessary to press 'Regenerate' because the chat doesn't allow you to continue. Last night, I was forced to use 'Regenerate' 10 times, and each time I received the same 'Network error.'

This issue is completely intolerable, as it makes OpenWebUI unusable.

<!-- gh-comment-id:2585751915 --> @loglux commented on GitHub (Jan 12, 2025): I found that the previous version still has the same problem. After encountering a 'Network error,' it's necessary to press 'Regenerate' because the chat doesn't allow you to continue. Last night, I was forced to use 'Regenerate' 10 times, and each time I received the same 'Network error.' This issue is completely intolerable, as it makes OpenWebUI unusable.
Author
Owner

@ayyazzafar commented on GitHub (Jan 12, 2025):

for me network issue is also on 0.5.3 version. is it working fine for you on 0.5.3 ?

<!-- gh-comment-id:2585754008 --> @ayyazzafar commented on GitHub (Jan 12, 2025): for me network issue is also on 0.5.3 version. is it working fine for you on 0.5.3 ?
Author
Owner

@loglux commented on GitHub (Jan 12, 2025):

No, it's not working fine for me on 0.5.3 either. It seems like this is an ongoing issue persisting from version to version.

<!-- gh-comment-id:2585754916 --> @loglux commented on GitHub (Jan 12, 2025): No, it's not working fine for me on 0.5.3 either. It seems like this is an ongoing issue persisting from version to version.
Author
Owner

@ayyazzafar commented on GitHub (Jan 12, 2025):

Yes you are right. I tried all versions one by one and it works upto v0.4.8 version. Above this version it does not work.

<!-- gh-comment-id:2585755724 --> @ayyazzafar commented on GitHub (Jan 12, 2025): Yes you are right. I tried all versions one by one and it works upto v0.4.8 version. Above this version it does not work.
Author
Owner

@loglux commented on GitHub (Jan 12, 2025):

Thank you. I was thinking about it. Rolling back to v0.4.8 right now. I worked long time on v0.4.3 and regret that started to follow updates.

P.S.
Works OK on v0.4.8

<!-- gh-comment-id:2585760977 --> @loglux commented on GitHub (Jan 12, 2025): Thank you. I was thinking about it. Rolling back to v0.4.8 right now. I worked long time on v0.4.3 and regret that started to follow updates. P.S. Works `OK` on v0.4.8
Author
Owner

@seadogger commented on GitHub (Jan 13, 2025):

I am not sure but it is something to due with caching. If you go the "About" page in user settings and the if the OpenWebUI Version is not showing the updated version you installed (e.g. v0.5.4) your session will give you this error after the first LLM response.

You have to clear this as it must be tied to the session id and validation of the user authentication. I am not sure what clears this and actually forces it to update to the version you have installed. Might have to clear browser cache as also make sure you are logged out of course. It eventually works for me. I did have this setup as a home page shortcut on my iPhone and I had to delete it and rebuild it by logging back in thru Safari and recreating the home page bookmark.

<!-- gh-comment-id:2586185437 --> @seadogger commented on GitHub (Jan 13, 2025): I am not sure but it is something to due with caching. If you go the "About" page in user settings and the if the OpenWebUI Version is not showing the updated version you installed (e.g. v0.5.4) your session will give you this error after the first LLM response. You have to clear this as it must be tied to the session id and validation of the user authentication. I am not sure what clears this and actually forces it to update to the version you have installed. Might have to clear browser cache as also make sure you are logged out of course. It eventually works for me. I did have this setup as a home page shortcut on my iPhone and I had to delete it and rebuild it by logging back in thru Safari and recreating the home page bookmark.
Author
Owner

@ayyazzafar commented on GitHub (Jan 13, 2025):

Hi @seadogger thank you so much for your message. You were right. Its some kind of cache / cache issue. I cleared it and now everything is working smoothly. Thanks a lot.

<!-- gh-comment-id:2586234615 --> @ayyazzafar commented on GitHub (Jan 13, 2025): Hi @seadogger thank you so much for your message. You were right. Its some kind of cache / cache issue. I cleared it and now everything is working smoothly. Thanks a lot.
Author
Owner

@pgbezerra commented on GitHub (Jan 13, 2025):

I understand the problem was a proxy misconfiguration.

However, we could extract something good from it. The error message is not very clear. We could add that the socket connection was rejected, at least for admin users.

<!-- gh-comment-id:2587899649 --> @pgbezerra commented on GitHub (Jan 13, 2025): I understand the problem was a proxy misconfiguration. However, we could extract something good from it. The error message is not very clear. We could add that the socket connection was rejected, at least for admin users.
Author
Owner

@Classic298 commented on GitHub (Jan 13, 2025):

Wow same for me, the error disappeared after refreshing a bunch of times and logging out and back in and clearing cache and cookies, something like this made all the error messages in the logs go away.
But then I am still wondering why it was sending broken websocket requests every second that were answered with 400 Bad Request...

<!-- gh-comment-id:2587914624 --> @Classic298 commented on GitHub (Jan 13, 2025): Wow same for me, the error disappeared after refreshing a bunch of times and logging out and back in and clearing cache and cookies, something like this made all the error messages in the logs go away. But then I am still wondering why it was sending broken websocket requests every second that were answered with 400 Bad Request...
Author
Owner

@jersam commented on GitHub (Jan 14, 2025):

v0.5.3

this worked for me for the moment.

<!-- gh-comment-id:2588554507 --> @jersam commented on GitHub (Jan 14, 2025): > ```shell > v0.5.3 > ``` this worked for me for the moment.
Author
Owner

@vdb1be commented on GitHub (Jan 15, 2025):

Was anyone using IIS as reverse proxy able to fix this?

<!-- gh-comment-id:2591780636 --> @vdb1be commented on GitHub (Jan 15, 2025): Was anyone using IIS as reverse proxy able to fix this?
Author
Owner

@jersam commented on GitHub (Jan 15, 2025):

NPMplus user here

On Tue, Jan 14, 2025, 10:55 PM vdb1be @.***> wrote:

Was anyone using IIS as reverse proxy able to fix this?


Reply to this email directly, view it on GitHub
https://github.com/open-webui/open-webui/issues/8074#issuecomment-2591780636,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AEG4H4HGBF6TX26ALDIULUT2KYA4ZAVCNFSM6AAAAABUGMYZ5KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKOJRG44DANRTGY
.
You are receiving this because you commented.Message ID:
@.***>

<!-- gh-comment-id:2591782308 --> @jersam commented on GitHub (Jan 15, 2025): NPMplus user here On Tue, Jan 14, 2025, 10:55 PM vdb1be ***@***.***> wrote: > Was anyone using IIS as reverse proxy able to fix this? > > — > Reply to this email directly, view it on GitHub > <https://github.com/open-webui/open-webui/issues/8074#issuecomment-2591780636>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AEG4H4HGBF6TX26ALDIULUT2KYA4ZAVCNFSM6AAAAABUGMYZ5KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKOJRG44DANRTGY> > . > You are receiving this because you commented.Message ID: > ***@***.***> >
Author
Owner

@loglux commented on GitHub (Jan 15, 2025):

I remain sceptical about a simple fix with Refresh. I tried and used it for a while, and the same issue remained the same, even though I cleaned up the working directory and installed clean v0.5.4

<!-- gh-comment-id:2591788292 --> @loglux commented on GitHub (Jan 15, 2025): I remain sceptical about a simple fix with Refresh. I tried and used it for a while, and the same issue remained the same, even though I cleaned up the working directory and installed clean v0.5.4
Author
Owner

@firestrife23 commented on GitHub (Jan 15, 2025):

Was anyone using IIS as reverse proxy able to fix this?

I hope you're joking, because I hardly come across those in my line of work as they are being phased out in favor of nginx, traefik, httpd, and npm. Except for those who are stuck in the Microsoft Camp. LOL

<!-- gh-comment-id:2593014091 --> @firestrife23 commented on GitHub (Jan 15, 2025): > Was anyone using IIS as reverse proxy able to fix this? I hope you're joking, because I hardly come across those in my line of work as they are being phased out in favor of nginx, traefik, httpd, and npm. Except for those who are stuck in the Microsoft Camp. LOL
Author
Owner

@finnaGIT commented on GitHub (Jan 16, 2025):

Here to report that I experience this issue in my implementation of HAProxy. However, per HAProxy documentation, Websockets are supported by default.

WebSocket

There is almost nothing needed to proxy WebSocket connections, other than to set timeouts and enable connection closing. The load balancer knows how to upgrade an HTTP connection to a WebSocket connection and once that happens, messages will travel back and forth through a WebSocket tunnel.


Is there something else going on here?

<!-- gh-comment-id:2596023508 --> @finnaGIT commented on GitHub (Jan 16, 2025): Here to report that I experience this issue in my implementation of HAProxy. However, per [HAProxy documentation](https://www.haproxy.com/documentation/haproxy-configuration-tutorials/load-balancing/websocket/), Websockets are supported by default. ## WebSocket There is almost nothing needed to proxy WebSocket connections, other than to set timeouts and enable connection closing. The load balancer knows how to upgrade an HTTP connection to a WebSocket connection and once that happens, messages will travel back and forth through a WebSocket tunnel. ___ Is there something else going on here?
Author
Owner

@linux-y commented on GitHub (Jan 17, 2025):

Issue: WebSocket Connections Failing Through Nginx Reverse Proxy

问题:通过 nginx 反向代理的 WebSocket 连接失败

Problem  问题

When using Nginx as a reverse proxy for a Dockerized app (exposed on localhost:3000), WebSocket connections fail. This is due to incorrect or missing headers in Nginx’s configuration, which are required to handle WebSocket protocol upgrades (ConnectionUpgrade headers).当使用 Nginx 作为 Dockerized 应用程序(在 localhost:3000 上公开)的反向代理时,WebSocket 连接失败。这是由于 Nginx 的配置中 header 不正确或缺失,而这些 header 是处理 WebSocket 协议升级(ConnectionUpgrade headers)所必需的。

Solution: Update Nginx Configuration for WebSocket Support解决方案:更新 Nginx 配置以支持 WebSocket

Core Changes:  核心变化:

Modify your Nginx HTTPS (443) server block to include WebSocket-specific headers. Here's the updated configuration:修改您的 Nginx HTTPS (443) 服务器块以包含特定于 WebSocket 的标头。以下是更新的配置:

server {
listen 443 ssl;
server_name example.com;

ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

location / {
    proxy_pass http://localhost:3000;  # Forward to Docker app

    # Add WebSocket support
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    # Standard headers
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # Timeouts for WebSocket connections
    proxy_read_timeout 60s;
    proxy_send_timeout 60s;
}

}
Optional: Add an HTTP (80) server block to redirect traffic to HTTPS:可选:添加 HTTP (80) 服务器块以将流量重定向到 HTTPS:

server {
listen 80;
server_name example.com;

return 301 https://$host$request_uri;

# Allow Certbot ACME challenges for SSL renewal
location ~ /.well-known/acme-challenge { allow all; }

}

Steps to Fix  修复步骤

  1. Edit the Nginx Configuration:编辑 nginx 配置
    Update your Nginx file, typically located in /etc/nginx/sites-available/<your-config>。更新你的 Nginx 文件,通常位于 /etc/nginx/sites-available/<your-config>

  2. Test the Changes:测试更改
    Validate configuration syntax:验证配置语法:
    sudo nginx -t

  3. Reload Nginx:  重新加载 nginx
    Apply the updated configuration:应用更新的配置:
    sudo systemctl reload nginx

  4. Validate WebSocket Connections:验证 WebSocket 连接

    • Open your app 和 inspect the WebSocket handshake in browser developer tools (F12 → Network → WS).打开您的应用程序并在浏览器开发人员工具 (F12 → Network → WS) 中检查 WebSocket 握手。
    • Alternatively, use curl to test WebSocket headers:
      或者,使用 curl 测试 WebSocket 标头:curl -i -N -H "Connection: Upgrade" -H "Upgrade: websocket" https://example.com

Results  结果

This configuration enables Nginx to properly handle WebSocket traffic by passing upgrade headers between the frontend 和 backend while maintaining SSL encryption. If issues persist, verify Docker container binding (0.0.0.0:3000), network accessibility, or check Nginx logs:此配置使 Nginx 能够通过在前端和后端之间传递升级标头来正���处理 WebSocket 流量,同时保持 SSL 加密。如果问题仍然存在,请验证 Docker 容器绑定 (0.0.0.0:3000)、网络可访问性或检查 Nginx 日志:

sudo tail -f /var/log/nginx/error.log

I started OpenWebUI using the official Docker command, so how should I resolve this network issue?
docker run -d -p 3000:8080 --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main

<!-- gh-comment-id:2597311929 --> @linux-y commented on GitHub (Jan 17, 2025): > # Issue: WebSocket Connections Failing Through Nginx Reverse Proxy > 问题:通过 nginx 反向代理的 WebSocket 连接失败 > ## **Problem  问题** > When using Nginx as a reverse proxy for a Dockerized app (exposed on `localhost:3000`), WebSocket connections fail. This is due to incorrect or missing headers in Nginx’s configuration, which are required to handle WebSocket protocol upgrades (`Connection` 和 `Upgrade` headers).当使用 Nginx 作为 Dockerized 应用程序(在 `localhost:3000` 上公开)的反向代理时,WebSocket 连接失败。这是由于 Nginx 的配置中 header 不正确或缺失,而这些 header 是处理 WebSocket 协议升级(`Connection` 和 `Upgrade` headers)所必需的。 > > ## **Solution: Update Nginx Configuration for WebSocket Support解决方案:更新 Nginx 配置以支持 WebSocket** > ### Core Changes:  核心变化: > Modify your Nginx **HTTPS (`443`) server block** to include WebSocket-specific headers. Here's the updated configuration:修改您的 Nginx **HTTPS (`443`) 服务器块**以包含特定于 WebSocket 的标头。以下是更新的配置: > > server { > listen 443 ssl; > server_name example.com; > > ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; > ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; > include /etc/letsencrypt/options-ssl-nginx.conf; > ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; > > location / { > proxy_pass http://localhost:3000; # Forward to Docker app > > # Add WebSocket support > proxy_http_version 1.1; > proxy_set_header Upgrade $http_upgrade; > proxy_set_header Connection "upgrade"; > > # Standard headers > proxy_set_header Host $host; > proxy_set_header X-Real-IP $remote_addr; > proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; > proxy_set_header X-Forwarded-Proto $scheme; > > # Timeouts for WebSocket connections > proxy_read_timeout 60s; > proxy_send_timeout 60s; > } > } > Optional: Add an HTTP (`80`) server block to redirect traffic to HTTPS:可选:添加 HTTP (`80`) 服务器块以将流量重定向到 HTTPS: > > server { > listen 80; > server_name example.com; > > return 301 https://$host$request_uri; > > # Allow Certbot ACME challenges for SSL renewal > location ~ /.well-known/acme-challenge { allow all; } > } > ## **Steps to Fix  修复步骤** > 1. **Edit the Nginx Configuration**:**编辑 nginx 配置**: > Update your Nginx file, typically located in `/etc/nginx/sites-available/<your-config>`。更新你的 Nginx 文件,通常位于 `/etc/nginx/sites-available/<your-config>` 。 > 2. **Test the Changes**:**测试更改**: > Validate configuration syntax:验证配置语法: > sudo nginx -t > 3. **Reload Nginx**:  **重新加载 nginx**: > Apply the updated configuration:应用更新的配置: > sudo systemctl reload nginx > 4. **Validate WebSocket Connections**:**验证 WebSocket 连接**: > > * Open your app 和 inspect the WebSocket handshake in browser developer tools (`F12` → Network → WS).打开您的应用程序并在浏览器开发人员工具 (`F12` → Network → WS) 中检查 WebSocket 握手。 > * Alternatively, use `curl` to test WebSocket headers: > 或者,使用 `curl` 测试 WebSocket 标头:curl -i -N -H "Connection: Upgrade" -H "Upgrade: websocket" https://example.com > > ## **Results  结果** > This configuration enables Nginx to properly handle WebSocket traffic by passing upgrade headers between the frontend 和 backend while maintaining SSL encryption. If issues persist, verify Docker container binding (`0.0.0.0:3000`), network accessibility, or check Nginx logs:此配置使 Nginx 能够通过在前端和后端之间传递升级标头来正���处理 WebSocket 流量,同时保持 SSL 加密。如果问题仍然存在,请验证 Docker 容器绑定 (`0.0.0.0:3000`)、网络可访问性或检查 Nginx 日志: > > sudo tail -f /var/log/nginx/error.log I started OpenWebUI using the official Docker command, so how should I resolve this network issue? docker run -d -p 3000:8080 --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main
Author
Owner

@loglux commented on GitHub (Jan 17, 2025):

I modified it before, and it didn't help. Moreover, it doesn't explain why the same error is present without a proxy.

<!-- gh-comment-id:2597313931 --> @loglux commented on GitHub (Jan 17, 2025): I modified it before, and it didn't help. Moreover, it doesn't explain why the same error is present without a proxy.
Author
Owner

@nvandenkolk commented on GitHub (Jan 17, 2025):

Image

<!-- gh-comment-id:2597836181 --> @nvandenkolk commented on GitHub (Jan 17, 2025): ![Image](https://github.com/user-attachments/assets/7e19c3d3-c761-40af-8e1e-128e013dc4d4)
Author
Owner

@Jeremy-Developer-Page commented on GitHub (Jan 22, 2025):

Hi this is a guide to fix Reverse Proxy Bad Request error and HTTPS Bad Request error.
This GUIDE works on 5.5 and 5.6 (that is the latest at the time of the post.)

To fix the problem do this in the reverse proxy:

Add WebSocket support

http_version 1.1;
Upgrade $http_upgrade;
Connection "upgrade";

If you use Synology reverse proxy there is a Setting dedicated to WebSocket that compiles automatically all.

Then if your reverse proxy is an HTTPS connection I suggest 2 fixes:

  1. Change all connection to HTTP

  2. Change the connection of OpenWebUI in https connection.

To do this second option go in backend/start.sh file (if you are running it on linux or macOS) and change the last line in:

WEBUI_SECRET_KEY="$WEBUI_SECRET_KEY" exec uvicorn open_webui.main:app \
  --host "$HOST" \
  --port "$PORT" \
  --forwarded-allow-ips '*' \
  --ssl-keyfile "absolute_folder/key.pem" \
  --ssl-certfile "absolute_folder/cert.pem"

Replacing the folder key and cert with the correct folder (if you haven’t a certificate you can create one with the openssl command).

Same is for Windows but the command change a little bit to adapt at the start_windows.bat file.

In this way the localhost run in https, and same is for local networks connections so you can have a full HTTPS connection without problems or limitation.

I hope this help to solve all problems related to this issue.

<!-- gh-comment-id:2608437080 --> @Jeremy-Developer-Page commented on GitHub (Jan 22, 2025): Hi this is a guide to fix Reverse Proxy Bad Request error and HTTPS Bad Request error. This GUIDE works on 5.5 and 5.6 (that is the latest at the time of the post.) To fix the problem do this in the reverse proxy: Add WebSocket support ``` http_version 1.1; Upgrade $http_upgrade; Connection "upgrade"; ``` If you use Synology reverse proxy there is a Setting dedicated to WebSocket that compiles automatically all. Then if your reverse proxy is an HTTPS connection I suggest 2 fixes: 1) Change all connection to HTTP 2) Change the connection of OpenWebUI in https connection. To do this second option go in backend/start.sh file (if you are running it on linux or macOS) and change the last line in: ``` WEBUI_SECRET_KEY="$WEBUI_SECRET_KEY" exec uvicorn open_webui.main:app \ --host "$HOST" \ --port "$PORT" \ --forwarded-allow-ips '*' \ --ssl-keyfile "absolute_folder/key.pem" \ --ssl-certfile "absolute_folder/cert.pem" ``` Replacing the folder key and cert with the correct folder (if you haven’t a certificate you can create one with the openssl command). Same is for Windows but the command change a little bit to adapt at the start_windows.bat file. In this way the localhost run in https, and same is for local networks connections so you can have a full HTTPS connection without problems or limitation. I hope this help to solve all problems related to this issue.
Author
Owner

@loglux commented on GitHub (Jan 23, 2025):

I got the 'Network Problem' error using OpenWebUI directly through the local IP address without Nginx proxy, etc.
v0.5.6
The version comes one after another, and the bug still exists.

So, let's concentrate on the real issue.

<!-- gh-comment-id:2610053736 --> @loglux commented on GitHub (Jan 23, 2025): I got the 'Network Problem' error using OpenWebUI directly through the local IP address without Nginx proxy, etc. v0.5.6 The version comes one after another, and the bug still exists. So, let's concentrate on the real issue.
Author
Owner

@Classic298 commented on GitHub (Jan 23, 2025):

I got the 'Network Problem' error using OpenWebUI directly through the local IP address without Nginx proxy, etc. v0.5.6 The version comes one after another, and the bug still exists.

So, let's concentrate on the real issue.

Did you delete cache and cookies and then try again?
Please do cuz it's necessary after updates.

If yes, pls show some logs of the issue.

<!-- gh-comment-id:2610103145 --> @Classic298 commented on GitHub (Jan 23, 2025): > I got the 'Network Problem' error using OpenWebUI directly through the local IP address without Nginx proxy, etc. v0.5.6 The version comes one after another, and the bug still exists. > > So, let's concentrate on the real issue. Did you delete cache and cookies and then try again? Please do cuz it's necessary after updates. If yes, pls show some logs of the issue.
Author
Owner

@Jeremy-Developer-Page commented on GitHub (Jan 23, 2025):

I got the 'Network Problem' error using OpenWebUI directly through the local IP address without Nginx proxy, etc. v0.5.6 The version comes one after another, and the bug still exists.

So, let's concentrate on the real issue.

Even in local IP it works for me, but my browser clean automatically cache and data after the reboot, so please do that and then show us some error logs or configuration that you think can generate issues.

Because without information is really difficult help someone.

Thanks 😄

<!-- gh-comment-id:2610169832 --> @Jeremy-Developer-Page commented on GitHub (Jan 23, 2025): > I got the 'Network Problem' error using OpenWebUI directly through the local IP address without Nginx proxy, etc. v0.5.6 The version comes one after another, and the bug still exists. > > So, let's concentrate on the real issue. Even in local IP it works for me, but my browser clean automatically cache and data after the reboot, so please do that and then show us some error logs or configuration that you think can generate issues. Because without information is really difficult help someone. Thanks 😄
Author
Owner

@glsup commented on GitHub (Jan 23, 2025):

In my case, (Windows 10, installed via miniconda and then cloning the repo) I still get the same as 0.5.0:

This is from the powershell were I run the "start_windows.bat":


/ _ \ _ __ ___ _ __ \ \ / /| | | | | |_ |
| | | | '
\ / _ \ '_ \ \ \ /\ / / _ \ '_ | | | || |
| || | |) | / | | | \ V V / / |) | || || |
_
/| .
/ _|| || _/_/ _|./ _/|_|
|
|

v0.5.6 - building the best open-source AI user interface.

https://github.com/open-webui/open-webui

Fetching 30 files: 100%|███████████████████████████████████████████████████████████████████████| 30/30 [00:00<?, ?it/s]
C:\ProgramData\miniconda3\envs\open-webui\Lib\site-packages\transformers\tokenization_utils_base.py:1601: FutureWarning: clean_up_tokenization_spaces was not set. It will be set to True by default. This behavior will be depracted in transformers v4.45, and will be then set to False by default. For more details check this issue: https://github.com/huggingface/transformers/issues/31884
warnings.warn(
INFO: Started server process [12044]
INFO: Waiting for application startup.
INFO: Application startup complete.
INFO: Uvicorn running on http://0.0.0.0:8080 (Press CTRL+C to quit)
Invalid transport (further occurrences of this error will be logged with level INFO)
ERROR [engineio.server] Invalid transport (further occurrences of this error will be logged with level INFO)
INFO: 127.0.0.1:60503 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCD8C HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:60506 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCDbq HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:60507 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCEyI HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:60504 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCF50 HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:60508 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCGAQ HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:60515 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCGY- HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:60508 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCHP3 HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:60516 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCI0b HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:60508 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCIdB HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:60523 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCJUJ HTTP/1.1" 400 Bad Request
INFO: 127.0.0.1:60525 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCJrr HTTP/1.1" 400 Bad Request

And then the "'session_id'" message in a browser that never used for this or in private windows of other browsers that I did use, after clearing the cache.

For me, the issue still remains the same.

Except for 0.4.8 which still works fine.

<!-- gh-comment-id:2610537803 --> @glsup commented on GitHub (Jan 23, 2025): In my case, (Windows 10, installed via miniconda and then cloning the repo) I still get the same as 0.5.0: This is from the powershell were I run the "start_windows.bat": ___ __ __ _ _ _ ___ / _ \ _ __ ___ _ __ \ \ / /__| |__ | | | |_ _| | | | | '_ \ / _ \ '_ \ \ \ /\ / / _ \ '_ \| | | || | | |_| | |_) | __/ | | | \ V V / __/ |_) | |_| || | \___/| .__/ \___|_| |_| \_/\_/ \___|_.__/ \___/|___| |_| v0.5.6 - building the best open-source AI user interface. https://github.com/open-webui/open-webui Fetching 30 files: 100%|███████████████████████████████████████████████████████████████████████| 30/30 [00:00<?, ?it/s] C:\ProgramData\miniconda3\envs\open-webui\Lib\site-packages\transformers\tokenization_utils_base.py:1601: FutureWarning: `clean_up_tokenization_spaces` was not set. It will be set to `True` by default. This behavior will be depracted in transformers v4.45, and will be then set to `False` by default. For more details check this issue: https://github.com/huggingface/transformers/issues/31884 warnings.warn( INFO: Started server process [12044] INFO: Waiting for application startup. INFO: Application startup complete. INFO: Uvicorn running on http://0.0.0.0:8080 (Press CTRL+C to quit) Invalid transport (further occurrences of this error will be logged with level INFO) ERROR [engineio.server] Invalid transport (further occurrences of this error will be logged with level INFO) INFO: 127.0.0.1:60503 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCD8C HTTP/1.1" 400 Bad Request INFO: 127.0.0.1:60506 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCDbq HTTP/1.1" 400 Bad Request INFO: 127.0.0.1:60507 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCEyI HTTP/1.1" 400 Bad Request INFO: 127.0.0.1:60504 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCF50 HTTP/1.1" 400 Bad Request INFO: 127.0.0.1:60508 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCGAQ HTTP/1.1" 400 Bad Request INFO: 127.0.0.1:60515 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCGY- HTTP/1.1" 400 Bad Request INFO: 127.0.0.1:60508 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCHP3 HTTP/1.1" 400 Bad Request INFO: 127.0.0.1:60516 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCI0b HTTP/1.1" 400 Bad Request INFO: 127.0.0.1:60508 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCIdB HTTP/1.1" 400 Bad Request INFO: 127.0.0.1:60523 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCJUJ HTTP/1.1" 400 Bad Request INFO: 127.0.0.1:60525 - "GET /ws/socket.io/?EIO=4&transport=polling&t=PIKCJrr HTTP/1.1" 400 Bad Request And then the "'session_id'" message in a browser that never used for this or in private windows of other browsers that I did use, after clearing the cache. For me, the issue still remains the same. Except for 0.4.8 which still works fine.
Author
Owner

@Krishnacore commented on GitHub (Jan 23, 2025):

I was finally able to fix this problem! Nothing worked with https until I looked at the documentation carefully. This worked for me!

https://docs.openwebui.com/tutorials/integrations/redis#configuring-open-webui

<!-- gh-comment-id:2610592662 --> @Krishnacore commented on GitHub (Jan 23, 2025): I was finally able to fix this problem! Nothing worked with https until I looked at the documentation carefully. This worked for me! https://docs.openwebui.com/tutorials/integrations/redis#configuring-open-webui
Author
Owner

@vdb1be commented on GitHub (Jan 24, 2025):

Was anyone using IIS as reverse proxy able to fix this?

I got it to work by disabeling websocket support. I used a pip install and set the env variable in powershell using

$env:ENABLE_WEBSOCKET_SUPPORT = 0

Also in IIS set the ARR > proxy settings > Reverse rewrite host in response headers to false
And last make sure the url rewrite action points to your local ip address and not localhost.

<!-- gh-comment-id:2612177184 --> @vdb1be commented on GitHub (Jan 24, 2025): > Was anyone using IIS as reverse proxy able to fix this? I got it to work by disabeling websocket support. I used a pip install and set the env variable in powershell using `$env:ENABLE_WEBSOCKET_SUPPORT = 0` Also in IIS set the ARR > proxy settings > Reverse rewrite host in response headers to false And last make sure the url rewrite action points to your local ip address and not localhost.
Author
Owner

@wyl2000 commented on GitHub (Jan 25, 2025):

The latest version using the default 0.0.0.0:8080 to access the dialog will appear Network Problem prompt, please change to 127.0.0.1:8080 to access and dialog, so it is normal, I do not know why this is the case, but I access this way it is normal, I was in windows 11 using conda to build a virtual environment created! The project normally uses the v2ray automatic system agent. After successful installation can be used without proxy, but the latest 0.5.7 version to use 127.0.0.1:8080 to normal use!

<!-- gh-comment-id:2613958899 --> @wyl2000 commented on GitHub (Jan 25, 2025): The latest version using the default 0.0.0.0:8080 to access the dialog will appear Network Problem prompt, please change to 127.0.0.1:8080 to access and dialog, so it is normal, I do not know why this is the case, but I access this way it is normal, I was in windows 11 using conda to build a virtual environment created! The project normally uses the v2ray automatic system agent. After successful installation can be used without proxy, but the latest 0.5.7 version to use 127.0.0.1:8080 to normal use!
Author
Owner

@shreyanshsaha commented on GitHub (Jan 26, 2025):

I had a similar problem
I updated the ip address to host.docker.internal

This is my setup:

  1. I have ollama running on WSL (port 11434)
  2. I ran open webui via docker
docker run -d -p 8080:8080 --gpus all --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data -e OLLAMA_BASE_URL=http://host.docker.internal:11434 --name open-webui --restart always ghcr.io/open-webui/open-webui:cuda

Here, I updated the OLLAMA Base URL to http://host.docker.internal:11434

  1. I can open the webui from 127.0.0.1, localhost and host.docker.internal

Only host.docker.internal works, for the other endpoints I only see the UI but its not able to connect to the model.

PS
I also have docker desktop installed on windows. The docker desktop can also manage containers installed on WSL 2

I have tried multiple other things, updating the OLLAMA Base URL, setting docker network as bridge or host, updating netsh to allow port communication. None of these steps worked.

<!-- gh-comment-id:2614302584 --> @shreyanshsaha commented on GitHub (Jan 26, 2025): I had a similar problem I updated the ip address to `host.docker.internal` This is my setup: 1. I have ollama running on WSL (port 11434) 2. I ran open webui via docker ``` docker run -d -p 8080:8080 --gpus all --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data -e OLLAMA_BASE_URL=http://host.docker.internal:11434 --name open-webui --restart always ghcr.io/open-webui/open-webui:cuda ``` Here, I updated the OLLAMA Base URL to `http://host.docker.internal:11434` 3. I can open the webui from 127.0.0.1, localhost and host.docker.internal Only `host.docker.internal` works, for the other endpoints I only see the UI but its not able to connect to the model. PS I also have docker desktop installed on windows. The docker desktop can also manage containers installed on WSL 2 I have tried multiple other things, updating the OLLAMA Base URL, setting docker network as bridge or host, updating netsh to allow port communication. None of these steps worked.
Author
Owner

@XGhozt commented on GitHub (Jan 27, 2025):

I'm on rockylinux with apache over ssl, this was the config that worked for me. I'm also not using docker. I've replaced the domain, obviously, so don't just copy paste this into your config without editing it.

/etc/httpd/conf.d/ai.conf

<IfModule mod_ssl.c>
    <VirtualHost *:443>
        ServerName ai.server.com
        ErrorLog logs/ai.server.com-error_log
        CustomLog logs/ai.server.com-access_log combined

        ProxyPreserveHost On
        ProxyPass /.well-known !

        # WebSocket Proxy
        ProxyPass "/ws/socket.io/" "ws://localhost:8080/ws/socket.io/"
        ProxyPassReverse "/ws/socket.io/" "ws://localhost:8080/ws/socket.io/"

        # HTTP Proxy
        ProxyPass "/" "http://localhost:8080/"
        ProxyPassReverse "/" "http://localhost:8080/"

        SSLCertificateFile /etc/letsencrypt/live/ai.server.com/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/ai.server.com/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf
    </VirtualHost>
</IfModule>
<!-- gh-comment-id:2616843550 --> @XGhozt commented on GitHub (Jan 27, 2025): I'm on rockylinux with apache over ssl, this was the config that worked for me. I'm also _not_ using docker. I've replaced the domain, obviously, so don't just copy paste this into your config without editing it. `/etc/httpd/conf.d/ai.conf` ``` <IfModule mod_ssl.c> <VirtualHost *:443> ServerName ai.server.com ErrorLog logs/ai.server.com-error_log CustomLog logs/ai.server.com-access_log combined ProxyPreserveHost On ProxyPass /.well-known ! # WebSocket Proxy ProxyPass "/ws/socket.io/" "ws://localhost:8080/ws/socket.io/" ProxyPassReverse "/ws/socket.io/" "ws://localhost:8080/ws/socket.io/" # HTTP Proxy ProxyPass "/" "http://localhost:8080/" ProxyPassReverse "/" "http://localhost:8080/" SSLCertificateFile /etc/letsencrypt/live/ai.server.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/ai.server.com/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf </VirtualHost> </IfModule> ```
Author
Owner

@loglux commented on GitHub (Jan 27, 2025):

Answering the question about cleaning up cookies. No, it doesn't help to eliminate this 'network error' bug.

<!-- gh-comment-id:2616847683 --> @loglux commented on GitHub (Jan 27, 2025): Answering the question about cleaning up cookies. No, it doesn't help to eliminate this 'network error' bug.
Author
Owner

@son12710 commented on GitHub (Jan 27, 2025):

Hi Guys, apparently i noticed that i had this issue today since i normally use it internally without going through NPM. When i tried to use it this morning outside of my home, i saw the same network error that people are talking about.
After reading all the comment in this article this morning, i noticed that the same solution doesnt work for everyone which indicate that something is probably causing an issue. I then look at my Cloudflare setup and bam, there it is, in Cloudflare -> your domain -> Network -> WebSocket was disabled. I enabled it and bam, no more network error

To sum up, there are 2 things I had to do to fix the issue i am having:
1 - Enable WebSocket in NGINX Proxy Manager
2 - Enable WebSocket on Cloudflare (if you are using it)

<!-- gh-comment-id:2616912491 --> @son12710 commented on GitHub (Jan 27, 2025): Hi Guys, apparently i noticed that i had this issue today since i normally use it internally without going through NPM. When i tried to use it this morning outside of my home, i saw the same network error that people are talking about. After reading all the comment in this article this morning, i noticed that the same solution doesnt work for everyone which indicate that something is probably causing an issue. I then look at my Cloudflare setup and bam, there it is, in Cloudflare -> your domain -> Network -> WebSocket was disabled. I enabled it and bam, no more network error To sum up, there are 2 things I had to do to fix the issue i am having: 1 - Enable WebSocket in NGINX Proxy Manager 2 - Enable WebSocket on Cloudflare (if you are using it)
Author
Owner

@pr0fsmith commented on GitHub (Jan 27, 2025):

proxy_pass http://127.0.0.1:8081;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;

This config works for me for 0.5.6. Didn't work on 0.5.7. Thanks for keeping this open.

<!-- gh-comment-id:2617206807 --> @pr0fsmith commented on GitHub (Jan 27, 2025): > proxy_pass http://127.0.0.1:8081; > proxy_http_version 1.1; > proxy_set_header Upgrade $http_upgrade; > proxy_set_header Connection 'upgrade'; > proxy_set_header Host $host; > proxy_cache_bypass $http_upgrade; This config works for me for 0.5.6. Didn't work on 0.5.7. Thanks for keeping this open.
Author
Owner

@Classic298 commented on GitHub (Jan 28, 2025):

@pr0fsmith did you delete cache after upgrading?

<!-- gh-comment-id:2618826324 --> @Classic298 commented on GitHub (Jan 28, 2025): @pr0fsmith did you delete cache after upgrading?
Author
Owner

@pr0fsmith commented on GitHub (Jan 28, 2025):

@pr0fsmith did you delete cache after upgrading?

No I didn't. I will try it now. The solution didn't work for me for the versions I listed before. It worked for one inquiry of the LLM then I got the same network error aftwards. I will update the results after I clear the cache.

<!-- gh-comment-id:2619126813 --> @pr0fsmith commented on GitHub (Jan 28, 2025): > [@pr0fsmith](https://github.com/pr0fsmith) did you delete cache after upgrading? No I didn't. I will try it now. The solution didn't work for me for the versions I listed before. It worked for one inquiry of the LLM then I got the same network error aftwards. I will update the results after I clear the cache.
Author
Owner

@pr0fsmith commented on GitHub (Jan 28, 2025):

@Classic298 Clearing the cache didn't work for me.
This is my config for nginx
`server {

listen        443 ssl;
server_name   olivi-ai.duckdns.org;
ssl_certificate /etc/letsencrypt/live/olivi-ai.duckdns.org/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/olivi-ai.duckdns.org/privkey.pem; # managed by Certbot
#include /etc/letsencrypt/options-ssl-nginx.conf;
#ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

# . files
location ~ /\.(?!well-known) {
    deny all;
}

security

add_header X-XSS-Protection          "1; mode=block" always;
add_header X-Content-Type-Options    "nosniff" always;
add_header Referrer-Policy           "no-referrer-when-downgrade" always;
add_header Content-Security-Policy   "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
add_header Permissions-Policy        "interest-cohort=()" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# . files
location ~ /\.(?!well-known) {
    deny all;
}

# reverse proxy
location / {
    proxy_pass            http://192.168.1.123:8080;
    proxy_set_header Host $host;

    proxy_http_version                 1.1;
    proxy_cache_bypass                 $http_upgrade;

    # Proxy SSL
    proxy_ssl_server_name              on;

    # Proxy headers
    #proxy_set_header Upgrade           $http_upgrade;
    #proxy_set_header Connection        "upgrade";
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host  $host;
    proxy_set_header X-Forwarded-Port  $server_port;

    # Proxy timeouts
    proxy_connect_timeout              60s;
    proxy_send_timeout                 60s;
    proxy_read_timeout                 60s;
}

}
`

<!-- gh-comment-id:2619149028 --> @pr0fsmith commented on GitHub (Jan 28, 2025): @Classic298 Clearing the cache didn't work for me. This is my config for nginx `server { listen 443 ssl; server_name olivi-ai.duckdns.org; ssl_certificate /etc/letsencrypt/live/olivi-ai.duckdns.org/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/olivi-ai.duckdns.org/privkey.pem; # managed by Certbot #include /etc/letsencrypt/options-ssl-nginx.conf; #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # . files location ~ /\.(?!well-known) { deny all; } # security add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "no-referrer-when-downgrade" always; add_header Content-Security-Policy "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always; add_header Permissions-Policy "interest-cohort=()" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; # . files location ~ /\.(?!well-known) { deny all; } # reverse proxy location / { proxy_pass http://192.168.1.123:8080; proxy_set_header Host $host; proxy_http_version 1.1; proxy_cache_bypass $http_upgrade; # Proxy SSL proxy_ssl_server_name on; # Proxy headers #proxy_set_header Upgrade $http_upgrade; #proxy_set_header Connection "upgrade"; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Port $server_port; # Proxy timeouts proxy_connect_timeout 60s; proxy_send_timeout 60s; proxy_read_timeout 60s; } } `
Author
Owner

@doodlebro commented on GitHub (Jan 29, 2025):

Does anyone have a working solution to this using NGINX proxy manager? Websocket support is enabled, but I have all sorts of issues, even after clearing all browser data and caching.

Most of the provided solutions are very hard to integrate with NPM. This shouldn't be such a boon!

<!-- gh-comment-id:2622448860 --> @doodlebro commented on GitHub (Jan 29, 2025): Does anyone have a working solution to this using NGINX proxy manager? Websocket support is enabled, but I have all sorts of issues, even after clearing all browser data and caching. Most of the provided solutions are very hard to integrate with NPM. This shouldn't be such a boon!
Author
Owner

@mattdrum commented on GitHub (Jan 29, 2025):

I use PFsense and HAProxy and was experiencing these network issues. Was able to resolve by setting the request the HAProxy timeout to 5 minutes instead of the default 30s. This was a problem because the first time I would load a model would take longer than 30 seconds.

<!-- gh-comment-id:2622833212 --> @mattdrum commented on GitHub (Jan 29, 2025): I use PFsense and HAProxy and was experiencing these network issues. Was able to resolve by setting the request the HAProxy timeout to 5 minutes instead of the default 30s. This was a problem because the first time I would load a model would take longer than 30 seconds.
Author
Owner

@scottrbaxter commented on GitHub (Jan 30, 2025):

@mattdrum Just FYI, I've also run this through haproxy on pfsense, and have not needed to change any timeouts from the defaults. Where it's great that you have found a resolution for your issue, it is unrelated to this network problem introduced in 0.5.

<!-- gh-comment-id:2623351299 --> @scottrbaxter commented on GitHub (Jan 30, 2025): @mattdrum Just FYI, I've also run this through haproxy on pfsense, and have not needed to change any timeouts from the defaults. Where it's great that you have found a resolution for your issue, it is unrelated to this network problem introduced in `0.5`.
Author
Owner

@jamesoram commented on GitHub (Jan 30, 2025):

I was seeing this issue after upgrading my local deployment through pip and it went away after clearing the browser cache (not saying this will solve the issue for more complex deployments but googling the error led me here).

<!-- gh-comment-id:2624229270 --> @jamesoram commented on GitHub (Jan 30, 2025): I was seeing this issue after upgrading my local deployment through pip and it went away after clearing the browser cache (not saying this will solve the issue for more complex deployments but googling the error led me here).
Author
Owner

@witten commented on GitHub (Jan 31, 2025):

I use PFsense and HAProxy and was experiencing these network issues. Was able to resolve by setting the request the HAProxy timeout to 5 minutes instead of the default 30s. This was a problem because the first time I would load a model would take longer than 30 seconds.

I had a similar but related solution work for me. I'm using HAProxy with Traefik, and I was getting the dreaded "Network Problem"s—not when loading a model but during a chat session. What apparently fixed it was setting the following in my haproxy.cfg:

defaults
    ...
    timeout tunnel 1h

This sets the WebSocket/tunnel timeout and doesn't impact other timeouts (connect, client, server).

<!-- gh-comment-id:2626205443 --> @witten commented on GitHub (Jan 31, 2025): > I use PFsense and HAProxy and was experiencing these network issues. Was able to resolve by setting the request the HAProxy timeout to 5 minutes instead of the default 30s. This was a problem because the first time I would load a model would take longer than 30 seconds. I had a similar but related solution work for me. I'm using HAProxy with Traefik, and I was getting the dreaded "Network Problem"s—not when loading a model but *during* a chat session. What apparently fixed it was setting the following in my `haproxy.cfg`: ``` defaults ... timeout tunnel 1h ``` This sets the WebSocket/tunnel timeout and doesn't impact other timeouts (`connect`, `client`, `server`).
Author
Owner

@paulwababu commented on GitHub (Feb 1, 2025):

We solved this issue by updating our Apache config to support websockets. We enabled proxy_wstunnel and added a rewrite rule for websocket upgrades. For example:

<VirtualHost *:80>
    ServerName abc.com
    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:8080/ retry=0
    ProxyPassReverse / http://127.0.0.1:8080/
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /(.*) ws://127.0.0.1:8080/$1 [P,L]
</VirtualHost>

This resolved our websocket issues with Open WebUI 0.5.0+. Hope it helps!

<!-- gh-comment-id:2629134956 --> @paulwababu commented on GitHub (Feb 1, 2025): We solved this issue by updating our Apache config to support websockets. We enabled `proxy_wstunnel` and added a rewrite rule for websocket upgrades. For example: ```apache <VirtualHost *:80> ServerName abc.com ProxyPreserveHost On ProxyPass / http://127.0.0.1:8080/ retry=0 ProxyPassReverse / http://127.0.0.1:8080/ RewriteEngine On RewriteCond %{HTTP:Upgrade} =websocket [NC] RewriteRule /(.*) ws://127.0.0.1:8080/$1 [P,L] </VirtualHost> ``` This resolved our websocket issues with Open WebUI 0.5.0+. Hope it helps!
Author
Owner

@lamteteeow commented on GitHub (Feb 1, 2025):

@paulwababu you might wanna delete the comment and submit it again because I can still see your domain from old edits :P

<!-- gh-comment-id:2629138307 --> @lamteteeow commented on GitHub (Feb 1, 2025): @paulwababu you might wanna delete the comment and submit it again because I can still see your domain from old edits :P
Author
Owner

@jmasclef commented on GitHub (Feb 2, 2025):

Using a Synology NAS reverse proxy, I had to activate websocket in custom header settings. Now it is working fine.

<!-- gh-comment-id:2629334491 --> @jmasclef commented on GitHub (Feb 2, 2025): Using a Synology NAS reverse proxy, I had to activate websocket in custom header settings. Now it is working fine.
Author
Owner

@arno608rw commented on GitHub (Feb 2, 2025):

将环境变量设置为 ENABLE_WEBSOCKET_SUPPORT=0 将禁用 WebSockets。

简单且有效的方法!!!谢谢!!!!

Good fixed

<!-- gh-comment-id:2629405911 --> @arno608rw commented on GitHub (Feb 2, 2025): > > 将环境变量设置为 ENABLE_WEBSOCKET_SUPPORT=0 将禁用 WebSockets。 > > 简单且有效的方法!!!谢谢!!!! Good fixed
Author
Owner

@joonsoome commented on GitHub (Feb 3, 2025):

I used Ollama on two different computers (one with lower parameters for low-end hardware, and one with moderate parameters). Occasionally, I encountered a "Network Problem" issue, which became even more frequent when Websearch was handled through SearXNG. Therefore, I created an Nginx GUI recipe that addresses both the problem mentioned in this thread and the WebSocket timeout issue. So far, it seems to be working without any problems.

# reference from : https://github.com/open-webui/open-webui/issues/8074
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

# prevent websocket timeout
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;

Image

<!-- gh-comment-id:2630452203 --> @joonsoome commented on GitHub (Feb 3, 2025): I used Ollama on two different computers (one with lower parameters for low-end hardware, and one with moderate parameters). Occasionally, I encountered a "Network Problem" issue, which became even more frequent when Websearch was handled through SearXNG. Therefore, I created an Nginx GUI recipe that addresses both the problem mentioned in this thread and the WebSocket timeout issue. So far, it seems to be working without any problems. ``` # reference from : https://github.com/open-webui/open-webui/issues/8074 proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # prevent websocket timeout proxy_read_timeout 3600s; proxy_send_timeout 3600s; ``` ![Image](https://github.com/user-attachments/assets/ba2cac7e-678f-4d2d-b85b-825a93e72b78)
Author
Owner

@scooter7 commented on GitHub (Feb 3, 2025):

Hi, I'm having this network problem error when trying to use web search. My instance is hosted on Railway from a dockerized template. Do you know how I can fix this? Thanks!

<!-- gh-comment-id:2631025551 --> @scooter7 commented on GitHub (Feb 3, 2025): Hi, I'm having this network problem error when trying to use web search. My instance is hosted on Railway from a dockerized template. Do you know how I can fix this? Thanks!
Author
Owner

@ticpu commented on GitHub (Feb 3, 2025):

The most aggravating part in this problem is that when this issue happens, it sticks.

The conversation is stuck with this message and can't be resumed, not even after a refresh.

The second part is that there's no retry once it says network problems, even after the AI responded.

I get the notification that the AI completed, I see the text appear as a notification and in the chatbox but that error remains, killing the conversation.

<!-- gh-comment-id:2632055763 --> @ticpu commented on GitHub (Feb 3, 2025): The most aggravating part in this problem is that when this issue happens, it sticks. The conversation is stuck with this message and can't be resumed, not even after a refresh. The second part is that there's no retry once it says network problems, even after the AI responded. I get the notification that the AI completed, I see the text appear as a notification and in the chatbox but that error remains, killing the conversation.
Author
Owner

@joecarpita commented on GitHub (Feb 4, 2025):

I used Ollama on two different computers (one with lower parameters for low-end hardware, and one with moderate parameters). Occasionally, I encountered a "Network Problem" issue, which became even more frequent when Websearch was handled through SearchXNG. Therefore, I created an Nginx GUI recipe that addresses both the problem mentioned in this thread and the WebSocket timeout issue. So far, it seems to be working without any problems.

# reference from : https://github.com/open-webui/open-webui/issues/8074
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

# prevent websocket timeout
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;

Image

@bear8203 Is this Nginx GUI recipe for Ollama or for SearXNG?

<!-- gh-comment-id:2632525431 --> @joecarpita commented on GitHub (Feb 4, 2025): > I used Ollama on two different computers (one with lower parameters for low-end hardware, and one with moderate parameters). Occasionally, I encountered a "Network Problem" issue, which became even more frequent when Websearch was handled through SearchXNG. Therefore, I created an Nginx GUI recipe that addresses both the problem mentioned in this thread and the WebSocket timeout issue. So far, it seems to be working without any problems. > > ``` > # reference from : https://github.com/open-webui/open-webui/issues/8074 > proxy_set_header Upgrade $http_upgrade; > proxy_set_header Connection "upgrade"; > proxy_set_header Host $host; > proxy_set_header X-Real-IP $remote_addr; > proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; > proxy_set_header X-Forwarded-Proto $scheme; > > # prevent websocket timeout > proxy_read_timeout 3600s; > proxy_send_timeout 3600s; > ``` > > ![Image](https://github.com/user-attachments/assets/ba2cac7e-678f-4d2d-b85b-825a93e72b78) @bear8203 Is this Nginx GUI recipe for Ollama or for SearXNG?
Author
Owner

@nyawox commented on GitHub (Feb 4, 2025):

@kim-gtek was right. for users encountering the NS_ERROR_NET_INTERRUPT issue with proper reverse proxy configuration, (it only worked on iOS for me) here’s a quick patch that mitigates it.
To verify websocket functionality, check if Active Users: 1 appears in the bottom left menu.

diff --git a/backend/open_webui/main.py b/backend/open_webui/main.py
index 00270aabc..e3c3e0947 100644
--- a/backend/open_webui/main.py
+++ b/backend/open_webui/main.py
@@ -714,24 +714,6 @@ async def check_url(request: Request, call_next):
     return response
 
 
-@app.middleware("http")
-async def inspect_websocket(request: Request, call_next):
-    if (
-        "/ws/socket.io" in request.url.path
-        and request.query_params.get("transport") == "websocket"
-    ):
-        upgrade = (request.headers.get("Upgrade") or "").lower()
-        connection = (request.headers.get("Connection") or "").lower().split(",")
-        # Check that there's the correct headers for an upgrade, else reject the connection
-        # This is to work around this upstream issue: https://github.com/miguelgrinberg/python-engineio/issues/367
-        if upgrade != "websocket" or "upgrade" not in connection:
-            return JSONResponse(
-                status_code=status.HTTP_400_BAD_REQUEST,
-                content={"detail": "Invalid WebSocket upgrade request"},
-            )
-    return await call_next(request)
-
-
 app.add_middleware(
     CORSMiddleware,
     allow_origins=CORS_ALLOW_ORIGIN,
  • I'm not familiar with the codebase and unknown side effects may exist, but it's better than not working at all.
  • while ENABLE_WEBSOCKET_SUPPORT=false also works the performance penalty was too significant for me
<!-- gh-comment-id:2633192903 --> @nyawox commented on GitHub (Feb 4, 2025): **@kim-gtek** was right. for users encountering the `NS_ERROR_NET_INTERRUPT` issue with proper reverse proxy configuration, (it only worked on iOS for me) here’s a quick patch that mitigates it. To verify websocket functionality, check if `Active Users: 1` appears in the bottom left menu. ```python diff --git a/backend/open_webui/main.py b/backend/open_webui/main.py index 00270aabc..e3c3e0947 100644 --- a/backend/open_webui/main.py +++ b/backend/open_webui/main.py @@ -714,24 +714,6 @@ async def check_url(request: Request, call_next): return response -@app.middleware("http") -async def inspect_websocket(request: Request, call_next): - if ( - "/ws/socket.io" in request.url.path - and request.query_params.get("transport") == "websocket" - ): - upgrade = (request.headers.get("Upgrade") or "").lower() - connection = (request.headers.get("Connection") or "").lower().split(",") - # Check that there's the correct headers for an upgrade, else reject the connection - # This is to work around this upstream issue: https://github.com/miguelgrinberg/python-engineio/issues/367 - if upgrade != "websocket" or "upgrade" not in connection: - return JSONResponse( - status_code=status.HTTP_400_BAD_REQUEST, - content={"detail": "Invalid WebSocket upgrade request"}, - ) - return await call_next(request) - - app.add_middleware( CORSMiddleware, allow_origins=CORS_ALLOW_ORIGIN, ``` - I'm not familiar with the codebase and unknown side effects may exist, but it's better than not working at all. - while `ENABLE_WEBSOCKET_SUPPORT=false` also works the performance penalty was too significant for me
Author
Owner

@joonsoome commented on GitHub (Feb 4, 2025):

I used Ollama on two different computers (one with lower parameters for low-end hardware, and one with moderate parameters). Occasionally, I encountered a "Network Problem" issue, which became even more frequent when Websearch was handled through SearchXNG. Therefore, I created an Nginx GUI recipe that addresses both the problem mentioned in this thread and the WebSocket timeout issue. So far, it seems to be working without any problems.

# reference from : https://github.com/open-webui/open-webui/issues/8074
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

# prevent websocket timeout
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;

Image

@bear8203 Is this Nginx GUI recipe for Ollama or for SearXNG?

This is for both, the proxy header for Open-webui 0.5+ (for Websocket), and Ollama(especially slow one) & SearXNG has more strict timing because of Websocket. so I make it more time to look. I made the reverse proxy at Open-webui, and the ollama & searxng at another nodes with local network to Open-webui

<!-- gh-comment-id:2633204320 --> @joonsoome commented on GitHub (Feb 4, 2025): > > I used Ollama on two different computers (one with lower parameters for low-end hardware, and one with moderate parameters). Occasionally, I encountered a "Network Problem" issue, which became even more frequent when Websearch was handled through SearchXNG. Therefore, I created an Nginx GUI recipe that addresses both the problem mentioned in this thread and the WebSocket timeout issue. So far, it seems to be working without any problems. > > ``` > > # reference from : https://github.com/open-webui/open-webui/issues/8074 > > proxy_set_header Upgrade $http_upgrade; > > proxy_set_header Connection "upgrade"; > > proxy_set_header Host $host; > > proxy_set_header X-Real-IP $remote_addr; > > proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; > > proxy_set_header X-Forwarded-Proto $scheme; > > > > # prevent websocket timeout > > proxy_read_timeout 3600s; > > proxy_send_timeout 3600s; > > ``` > > > > > > > > > > > > > > > > > > > > > > > > ![Image](https://github.com/user-attachments/assets/ba2cac7e-678f-4d2d-b85b-825a93e72b78) > > [@bear8203](https://github.com/bear8203) Is this Nginx GUI recipe for Ollama or for SearXNG? This is for both, the proxy header for Open-webui 0.5+ (for Websocket), and Ollama(especially slow one) & SearXNG has more strict timing because of Websocket. so I make it more time to look. I made the reverse proxy at Open-webui, and the ollama & searxng at another nodes with local network to Open-webui
Author
Owner

@shegman6000 commented on GitHub (Feb 4, 2025):

I know some people have had issues when running this with an nginx ingress controller on EKS.

To clarify - if you are installing via helmchart, then add this to the ingress section of the helm chart:

          annotations: {
            "nginx.ingress.kubernetes.io/proxy-http-version": "1.1",
            "nginx.ingress.kubernetes.io/connection-proxy-header": "upgrade",
          } 

(The above is done in CDK but will also apply to flat yaml files!)

This will result in the annotations on your ingress resource containing:

metadata:                                                                                                                                                   │
│   annotations:                                                                                                                                              │
                                                                                                     │
│     nginx.ingress.kubernetes.io/connection-proxy-header: upgrade                                                                                            │
│     nginx.ingress.kubernetes.io/proxy-http-version: "1.1"    

Then the nginx config will update.

<!-- gh-comment-id:2633647750 --> @shegman6000 commented on GitHub (Feb 4, 2025): I know some people have had issues when running this with an nginx ingress controller on EKS. To clarify - if you are installing via helmchart, then add this to the ingress section of the helm chart: ``` annotations: { "nginx.ingress.kubernetes.io/proxy-http-version": "1.1", "nginx.ingress.kubernetes.io/connection-proxy-header": "upgrade", } ``` (The above is done in CDK but will also apply to flat yaml files!) This will result in the annotations on your ingress resource containing: ``` metadata: │ │ annotations: │ │ │ nginx.ingress.kubernetes.io/connection-proxy-header: upgrade │ │ nginx.ingress.kubernetes.io/proxy-http-version: "1.1" ``` Then the nginx config will update.
Author
Owner

@scooter7 commented on GitHub (Feb 4, 2025):

Hi @tjbck , Is this issue something that will be fixed in a future release? Thanks!

<!-- gh-comment-id:2633988389 --> @scooter7 commented on GitHub (Feb 4, 2025): Hi @tjbck , Is this issue something that will be fixed in a future release? Thanks!
Author
Owner

@nwhobart commented on GitHub (Feb 4, 2025):

"nginx.ingress.kubernetes.io/proxy-http-version": "1.1",
"nginx.ingress.kubernetes.io/connection-proxy-header": "upgrade",

no dice here

 2025-02-04T14:55:22.369725621Z: error updating the resource "open-webui":
    cannot patch "open-webui" with kind Ingress: admission webhook "validate.nginx.ingress.kubernetes.io" denied the
 request: annotation nginx.ingress.kubernetes.io/connection-proxy-header contains invalid value
 2025-02-04T14:55:22.382648866Z: warning: Upgrade "open-webui" failed: cannot patch "open-webui" with kind Ingress: a
 dmission webhook "validate.nginx.ingress.kubernetes.io" denied the request: annotation nginx.ingress.kubernetes.io/c
 onnection-proxy-header contains invalid value
<!-- gh-comment-id:2634241444 --> @nwhobart commented on GitHub (Feb 4, 2025): > "nginx.ingress.kubernetes.io/proxy-http-version": "1.1", > "nginx.ingress.kubernetes.io/connection-proxy-header": "upgrade", no dice here ``` 2025-02-04T14:55:22.369725621Z: error updating the resource "open-webui": cannot patch "open-webui" with kind Ingress: admission webhook "validate.nginx.ingress.kubernetes.io" denied the request: annotation nginx.ingress.kubernetes.io/connection-proxy-header contains invalid value 2025-02-04T14:55:22.382648866Z: warning: Upgrade "open-webui" failed: cannot patch "open-webui" with kind Ingress: a dmission webhook "validate.nginx.ingress.kubernetes.io" denied the request: annotation nginx.ingress.kubernetes.io/c onnection-proxy-header contains invalid value ```
Author
Owner

@nwhobart commented on GitHub (Feb 4, 2025):

This issue is incredibly frustrating. To try to mitigate we've:

  • Set up an RDS Postgres db in AWS
  • Set up a Valkey cache in AWS
  • Made all the appropriate changes to our values.yaml file (We use a Helm chart for AWS EKS 1.29)
  • Experimented with multiple nginx annotations

We still see the networking issues error and are unable to run multiple replicas and use OIDC at the same time. I'm not sure how unique our situation is or if others have a similar set up.

Would love to use this more and contribute when able but right now this does not feel production ready.

<!-- gh-comment-id:2634299120 --> @nwhobart commented on GitHub (Feb 4, 2025): This issue is incredibly frustrating. To try to mitigate we've: - Set up an RDS Postgres db in AWS - Set up a Valkey cache in AWS - Made all the appropriate changes to our `values.yaml` file (We use a Helm chart for AWS EKS 1.29) - Experimented with _multiple_ `nginx` annotations We _still_ see the networking issues error and are unable to run multiple replicas and use OIDC at the same time. I'm not sure how unique our situation is or if others have a similar set up. Would love to use this more and contribute when able but right now this does not feel production ready.
Author
Owner

@ticpu commented on GitHub (Feb 4, 2025):

The core issue remains, and this ticket is becoming cloud provider, deployment and helm support hub and discussion. Can we please focus on the issue?

It breaks and times out after a while or on reload with pure Nginx. Any cloud, GUI or abstraction to Nginx will continue to fail until the core issue is resolved.

Even with HTTP upgrade to websocket and long timeouts setup, the Network Error still present itself after a while or after an AI has been reasoning for too rong, killing the conversation.

Does it affect Apache, Nginx and HaProxy equally? Maybe we can test this out first?

<!-- gh-comment-id:2634387739 --> @ticpu commented on GitHub (Feb 4, 2025): The core issue remains, and this ticket is becoming cloud provider, deployment and helm support hub and discussion. Can we please focus on the issue? It breaks and times out after a while or on reload with pure Nginx. Any cloud, GUI or abstraction to Nginx will continue to fail until the core issue is resolved. Even with HTTP upgrade to websocket and long timeouts setup, the Network Error still present itself after a while or after an AI has been reasoning for too rong, killing the conversation. Does it affect Apache, Nginx and HaProxy equally? Maybe we can test this out first?
Author
Owner

@gaibz commented on GitHub (Feb 5, 2025):

Just using nginx with this Config and it works with docker container and my current workflow :

upstream openwebui_backend {
    server 127.0.0.1:3000;
}

server {
    server_name your_server_name;

    location / {
        proxy_pass http://openwebui_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # adding support for WebSocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
    }
}
<!-- gh-comment-id:2635489295 --> @gaibz commented on GitHub (Feb 5, 2025): Just using nginx with this Config and it works with docker container and my current workflow : ```nginx upstream openwebui_backend { server 127.0.0.1:3000; } server { server_name your_server_name; location / { proxy_pass http://openwebui_backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # adding support for WebSocket proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; } } ```
Author
Owner

@ticpu commented on GitHub (Feb 5, 2025):

Yet, this one fails to work correctly when o3 is reasoning for too long and I still get Network Error.

I'm using Nginx especially for HTTPS so this is my use-case. I'm willing to try Apache if it works better but I've been using Nginx for years. I have WebSocket configured for Grafana and Jellyfin as well without issue using a very similar config (in fact the SSL stuff is a snippet).

server {
	listen 443 ssl;
	listen [::]:443 ssl;
	http2 on;

	set $owui http://172.20.20.10:3000;

	ssl_certificate /etc/letsencrypt/...
	ssl_certificate_key /etc/letsencrypt/...
	ssl_session_timeout 1d;
	ssl_session_cache shared:SSL:50m;
	ssl_session_tickets off;
	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
	ssl_prefer_server_ciphers on;
	ssl_stapling on;
	ssl_stapling_verify on;

	server_name mydomain.net;

	location / {
		proxy_pass $owui;

		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "upgrade";

		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}
}
<!-- gh-comment-id:2635571685 --> @ticpu commented on GitHub (Feb 5, 2025): Yet, this one fails to work correctly when o3 is reasoning for too long and I still get Network Error. I'm using Nginx especially for HTTPS so this is my use-case. I'm willing to try Apache if it works better but I've been using Nginx for years. I have WebSocket configured for Grafana and Jellyfin as well without issue using a very similar config (in fact the SSL stuff is a snippet). ```nginx server { listen 443 ssl; listen [::]:443 ssl; http2 on; set $owui http://172.20.20.10:3000; ssl_certificate /etc/letsencrypt/... ssl_certificate_key /etc/letsencrypt/... ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; ssl_session_tickets off; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'; ssl_prefer_server_ciphers on; ssl_stapling on; ssl_stapling_verify on; server_name mydomain.net; location / { proxy_pass $owui; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } ```
Author
Owner

@May-Yaha commented on GitHub (Feb 5, 2025):

upstream chat_service_main {
server 127.0.0.1:8023;
}
upstream chat_service_ollama_api {
server 127.0.0.1:11434;
}

server {
listen 8999 ;
server_name xxx;
# 定义location块
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# WebSocket 相关配置
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_pass http://chat_service_main;
break;
}
location /ollama_api/ {
if ($host = chat.flyaha.top) {
rewrite ^/ollama_api/(.*)$ /$1 break;
proxy_pass http://chat_service_ollama_api;
}
}
}

<!-- gh-comment-id:2635820947 --> @May-Yaha commented on GitHub (Feb 5, 2025): upstream chat_service_main { server 127.0.0.1:8023; } upstream chat_service_ollama_api { server 127.0.0.1:11434; } server { listen 8999 ; server_name xxx; # 定义location块 location / { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # WebSocket 相关配置 proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_pass http://chat_service_main; break; } location /ollama_api/ { if ($host = chat.flyaha.top) { rewrite ^/ollama_api/(.*)$ /$1 break; proxy_pass http://chat_service_ollama_api; } } }
Author
Owner

@jmtatsch commented on GitHub (Feb 5, 2025):

For me it was the firewall blocking the communication.
Look in your syslog for entries like this one:

[UFW BLOCK] IN=br-790ac8044c00 OUT= MAC=02:42:e6:8b:06:0e:02:42:ac:1a:00:03:08:00 SRC=172.26.0.3 DST=172.17.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=8522 DF PROTO=TCP SPT=40372 DPT=11434 WINDOW=64240 RES=0x00 SYN URGP=0

The you can just whitelist the source ip as follows:

sudo ufw allow proto tcp from 172.26.0.3

<!-- gh-comment-id:2637649985 --> @jmtatsch commented on GitHub (Feb 5, 2025): For me it was the firewall blocking the communication. Look in your syslog for entries like this one: `[UFW BLOCK] IN=br-790ac8044c00 OUT= MAC=02:42:e6:8b:06:0e:02:42:ac:1a:00:03:08:00 SRC=172.26.0.3 DST=172.17.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=8522 DF PROTO=TCP SPT=40372 DPT=11434 WINDOW=64240 RES=0x00 SYN URGP=0 ` The you can just whitelist the source ip as follows: `sudo ufw allow proto tcp from 172.26.0.3`
Author
Owner

@i0ntempest commented on GitHub (Feb 6, 2025):

Anyone getting Execution Time Limit Exceeded in code intepreter when using a reverse proxy? I have nginx as a https proxy in front of the webui, and I get Execution Time Limit Exceeded when trying to execute any code. Connecting without the proxy and it works fine.

EDIT: Figured it out, Content-Security-Policy settings in nginx config blocked it

<!-- gh-comment-id:2638902741 --> @i0ntempest commented on GitHub (Feb 6, 2025): Anyone getting `Execution Time Limit Exceeded` in code intepreter when using a reverse proxy? I have nginx as a https proxy in front of the webui, and I get `Execution Time Limit Exceeded` when trying to execute any code. Connecting without the proxy and it works fine. EDIT: Figured it out, Content-Security-Policy settings in nginx config blocked it
Author
Owner

@Jarome07 commented on GitHub (Feb 7, 2025):

If you use frp,You can add the following configuration to the last line of frpc.toml

[[proxies]]
name = "websocket"
type = "tcp"
localIP = "127.0.0.1"
localPort = 8080
remotePort = 0
<!-- gh-comment-id:2641882391 --> @Jarome07 commented on GitHub (Feb 7, 2025): If you use frp,You can add the following configuration to the last line of frpc.toml ``` [[proxies]] name = "websocket" type = "tcp" localIP = "127.0.0.1" localPort = 8080 remotePort = 0 ```
Author
Owner

@cbartol commented on GitHub (Feb 7, 2025):

For anyone using Synology for a reverse proxy.
I just added these custom headers to the Reverse Proxy Rules and it fixed it

Upgrade        $http_upgrade
Connection     $connection_upgrade

(you can also click Create > WebSocket for it to be automatically created)

<!-- gh-comment-id:2644018942 --> @cbartol commented on GitHub (Feb 7, 2025): For anyone using Synology for a reverse proxy. I just added these custom headers to the Reverse Proxy Rules and it fixed it ``` Upgrade $http_upgrade Connection $connection_upgrade ``` (you can also click Create > WebSocket for it to be automatically created)
Author
Owner

@spammenotinoz commented on GitHub (Feb 11, 2025):

Yet, this one fails to work correctly when o3 is reasoning for too long and I still get Network Error.

I'm using Nginx especially for HTTPS so this is my use-case. I'm willing to try Apache if it works better but I've been using Nginx for years. I have WebSocket configured for Grafana and Jellyfin as well without issue using a very similar config (in fact the SSL stuff is a snippet).

server {
listen 443 ssl;
listen [::]:443 ssl;
http2 on;

set $owui http://172.20.20.10:3000;

ssl_certificate /etc/letsencrypt/...
ssl_certificate_key /etc/letsencrypt/...
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;
ssl_stapling on;
ssl_stapling_verify on;

server_name mydomain.net;

location / {
proxy_pass $owui;

  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";

  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;

}
}

You need to increase your timeouts, the below are the defaults, you need to increase and manage as appropriate;
client_body_timeout: 60 seconds. This specifies the maximum time for reading the client request body
client_header_timeout: 60 seconds. This defines the maximum time for reading the client request header
keepalive_timeout: 75 seconds. This sets the time an idle connection to a client remains open
proxy_read_timeout: 60 seconds. This is the time NGINX waits for a response from a proxied server after a connection is established
proxy_connect_timeout: 60 seconds.
send_timeout: 60 seconds.

<!-- gh-comment-id:2649758079 --> @spammenotinoz commented on GitHub (Feb 11, 2025): > Yet, this one fails to work correctly when o3 is reasoning for too long and I still get Network Error. > > I'm using Nginx especially for HTTPS so this is my use-case. I'm willing to try Apache if it works better but I've been using Nginx for years. I have WebSocket configured for Grafana and Jellyfin as well without issue using a very similar config (in fact the SSL stuff is a snippet). > > server { > listen 443 ssl; > listen [::]:443 ssl; > http2 on; > > set $owui http://172.20.20.10:3000; > > ssl_certificate /etc/letsencrypt/... > ssl_certificate_key /etc/letsencrypt/... > ssl_session_timeout 1d; > ssl_session_cache shared:SSL:50m; > ssl_session_tickets off; > ssl_protocols TLSv1.2 TLSv1.3; > ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'; > ssl_prefer_server_ciphers on; > ssl_stapling on; > ssl_stapling_verify on; > > server_name mydomain.net; > > location / { > proxy_pass $owui; > > proxy_http_version 1.1; > proxy_set_header Upgrade $http_upgrade; > proxy_set_header Connection "upgrade"; > > proxy_set_header Host $host; > proxy_set_header X-Real-IP $remote_addr; > proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; > proxy_set_header X-Forwarded-Proto $scheme; > } > } You need to increase your timeouts, the below are the defaults, you need to increase and manage as appropriate; client_body_timeout: 60 seconds. This specifies the maximum time for reading the client request body client_header_timeout: 60 seconds. This defines the maximum time for reading the client request header keepalive_timeout: 75 seconds. This sets the time an idle connection to a client remains open proxy_read_timeout: 60 seconds. This is the time NGINX waits for a response from a proxied server after a connection is established proxy_connect_timeout: 60 seconds. send_timeout: 60 seconds.
Author
Owner

@apunkt commented on GitHub (Feb 11, 2025):

Anyone getting Execution Time Limit Exceeded in code intepreter when using a reverse proxy? I have nginx as a https proxy in front of the webui, and I get Execution Time Limit Exceeded when trying to execute any code. Connecting without the proxy and it works fine.

EDIT: Figured it out, Content-Security-Policy settings in nginx config blocked it

me,
what exactly is required to fix it @i0ntempest ?

<!-- gh-comment-id:2651053851 --> @apunkt commented on GitHub (Feb 11, 2025): > Anyone getting `Execution Time Limit Exceeded` in code intepreter when using a reverse proxy? I have nginx as a https proxy in front of the webui, and I get `Execution Time Limit Exceeded` when trying to execute any code. Connecting without the proxy and it works fine. > > EDIT: Figured it out, Content-Security-Policy settings in nginx config blocked it me, what exactly is required to fix it @i0ntempest ?
Author
Owner

@i0ntempest commented on GitHub (Feb 12, 2025):

Anyone getting Execution Time Limit Exceeded in code intepreter when using a reverse proxy? I have nginx as a https proxy in front of the webui, and I get Execution Time Limit Exceeded when trying to execute any code. Connecting without the proxy and it works fine.
EDIT: Figured it out, Content-Security-Policy settings in nginx config blocked it

me, what exactly is required to fix it @i0ntempest ?

Delete any Content-Security-Policy lines in your nguni config

<!-- gh-comment-id:2653826035 --> @i0ntempest commented on GitHub (Feb 12, 2025): > > Anyone getting `Execution Time Limit Exceeded` in code intepreter when using a reverse proxy? I have nginx as a https proxy in front of the webui, and I get `Execution Time Limit Exceeded` when trying to execute any code. Connecting without the proxy and it works fine. > > EDIT: Figured it out, Content-Security-Policy settings in nginx config blocked it > > me, what exactly is required to fix it [<img alt="" width="16" height="16" src="https://avatars.githubusercontent.com/u/16017904?u=6d639b84a7f4975fdbd14ca3e2b2fc999ed29cbe&amp;v=4&amp;size=80">@i0ntempest](https://github.com/i0ntempest) ? Delete any Content-Security-Policy lines in your nguni config
Author
Owner

@InventoCasa commented on GitHub (Feb 12, 2025):

Anyone getting Execution Time Limit Exceeded in code intepreter when using a reverse proxy? I have nginx as a https proxy in front of the webui, and I get Execution Time Limit Exceeded when trying to execute any code. Connecting without the proxy and it works fine.
EDIT: Figured it out, Content-Security-Policy settings in nginx config blocked it

me, what exactly is required to fix it @i0ntempest ?

Delete any Content-Security-Policy lines in your nguni config

Unfortunately that ist not working with my config. Can you share your complete nginx.conf ?

<!-- gh-comment-id:2653831080 --> @InventoCasa commented on GitHub (Feb 12, 2025): > > > Anyone getting `Execution Time Limit Exceeded` in code intepreter when using a reverse proxy? I have nginx as a https proxy in front of the webui, and I get `Execution Time Limit Exceeded` when trying to execute any code. Connecting without the proxy and it works fine. > > > EDIT: Figured it out, Content-Security-Policy settings in nginx config blocked it > > > > > > me, what exactly is required to fix it [<img alt="" width="16" height="16" src="https://avatars.githubusercontent.com/u/16017904?u=6d639b84a7f4975fdbd14ca3e2b2fc999ed29cbe&amp;v=4&amp;size=80">@i0ntempest](https://github.com/i0ntempest) ? > > Delete any Content-Security-Policy lines in your nguni config Unfortunately that ist not working with my config. Can you share your complete nginx.conf ?
Author
Owner

@rsugumar commented on GitHub (Feb 13, 2025):

I'm using nginx-proxy-manager. Is there any such fix for nginx-proxy-manager? (BTW, this error doesn't exist in the old v0.4.8, so I'm going back to this version instead of latest) Thanks!

<!-- gh-comment-id:2655761829 --> @rsugumar commented on GitHub (Feb 13, 2025): I'm using nginx-proxy-manager. Is there any such fix for nginx-proxy-manager? (BTW, this error doesn't exist in the old v0.4.8, so I'm going back to this version instead of latest) Thanks!
Author
Owner

@ciprianveg commented on GitHub (Feb 13, 2025):

The problem is that you need a proper websocket support going forward with 0.5.0+. Instead of a lot of people reverting to 0.4.8, couldn't be added an option in the settings to use the previous transfer mode for the ones that can not use the new websocket transfer mode?

<!-- gh-comment-id:2656589329 --> @ciprianveg commented on GitHub (Feb 13, 2025): The problem is that you need a proper websocket support going forward with 0.5.0+. Instead of a lot of people reverting to 0.4.8, couldn't be added an option in the settings to use the previous transfer mode for the ones that can not use the new websocket transfer mode?
Author
Owner

@DuckyBlender commented on GitHub (Feb 15, 2025):

I'm getting Error 403 for XHRPOST /api/v1/audio/transcriptions any ideas? This is my nginx config

server {
        listen 80;
        server_name domain.net;

        location / {
			proxy_pass http://open-webui:8080;
			
			# Add WebSocket support
			proxy_http_version 1.1;
			proxy_set_header Upgrade $http_upgrade;
			proxy_set_header Connection "upgrade";

			# Standard headers
			proxy_set_header Host $host;
			proxy_set_header X-Real-IP $remote_addr;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_set_header X-Forwarded-Proto $scheme;

			# Timeouts for WebSocket connections
			proxy_read_timeout 60s;
			proxy_send_timeout 60s;
        }
    }

edit: the issue is with cloudflare. it's returning the "just a moment..." page, still have no idea why

<!-- gh-comment-id:2660899217 --> @DuckyBlender commented on GitHub (Feb 15, 2025): I'm getting Error 403 for XHRPOST /api/v1/audio/transcriptions any ideas? This is my nginx config ``` server { listen 80; server_name domain.net; location / { proxy_pass http://open-webui:8080; # Add WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; # Standard headers proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # Timeouts for WebSocket connections proxy_read_timeout 60s; proxy_send_timeout 60s; } } ``` edit: the issue is with cloudflare. it's returning the "just a moment..." page, still have no idea why
Author
Owner

@doodlebro commented on GitHub (Feb 19, 2025):

How many times can an issue be referenced before we acknowledge that more can be done?

<!-- gh-comment-id:2669120557 --> @doodlebro commented on GitHub (Feb 19, 2025): How many times can an issue be referenced before we acknowledge that more can be done?
Author
Owner

@firestrife23 commented on GitHub (Feb 19, 2025):

How many times can an issue be referenced before we acknowledge that more can be done?

Eh, there are no cut and dry answers. As far as I can tell, a couple of containers running on my machine have no issues with WebSockets while sitting behind Traefik, but for some reason, OpenWeb-UI is the only one having this issue.

<!-- gh-comment-id:2669777826 --> @firestrife23 commented on GitHub (Feb 19, 2025): > How many times can an issue be referenced before we acknowledge that more can be done? Eh, there are no cut and dry answers. As far as I can tell, a couple of containers running on my machine have no issues with WebSockets while sitting behind Traefik, but for some reason, OpenWeb-UI is the only one having this issue.
Author
Owner

@XGhozt commented on GitHub (Feb 20, 2025):

I'm surprised this issue is still on-going. The ironic part is most of you here could post your config to your local AI and have it update it for you. I was able to update my config and pass the websocket packets on through my reverse proxy. There isn't really anything openwebui needs to do here.

There isn't one answer for everyone because it depends on your environment. Apache, nginx, caddy, cloudflare, ssl vs non-ssl, domain or sub domain, etc... (An aside with cloudflare, you have to actually enabled it first).

On my servers I'm using apache with let's encrypt for the SSL cert. I posted my apache config earlier. Below is a rough example, you can use this to google/search the rest or use AI to assist in building the config for your own setup.

You're adding support for websockets, you must have any related modules for your website enabled and installed (most likely you already have them by default). The below would be part of your config specifically for the web socket connection. We just need the "/ws/socket.io" to connect, you don't need web sockets setup at the root of the config.

For apache, you need something like this:

<IfModule mod_ssl.c>
    <VirtualHost *:443>
        ServerName ai.server.com
        ErrorLog logs/ai.server.com-error_log
        CustomLog logs/ai.server.com-access_log combined

        ProxyPreserveHost On
        ProxyPass /.well-known !

        ProxyPass "/ws/socket.io/" "ws://localhost:8080/ws/socket.io/"
        ProxyPassReverse "/ws/socket.io/" "ws://localhost:8080/ws/socket.io/"

        ProxyPass "/" "http://localhost:8080/"
        ProxyPassReverse "/" "http://localhost:8080/"

        SSLCertificateFile /etc/letsencrypt/live/ai.server.com/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/ai.server.com/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf
    </VirtualHost>
</IfModule>

The nginx equivalent this this is something like:

server {
    listen 443 ssl;
    server_name ai.server.com;

    ssl_certificate /etc/letsencrypt/live/ai.server.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ai.server.com/privkey.pem;

    location /.well-known/ {
        # ...
    }

    location /ws/socket.io/ {
        proxy_pass http://localhost:8080/ws/socket.io/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }

    location / {
        proxy_pass http://localhost:8080/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

For caddy:

ai.server.com {
    tls /etc/letsencrypt/live/ai.server.com/fullchain.pem /etc/letsencrypt/live/ai.server.com/privkey.pem

    @socketio {
        path /ws/socket.io/*
    }
    reverse_proxy @socketio ws://localhost:8080/ws/socket.io/

    reverse_proxy / http://localhost:8080/
}

Side notes;
If I am missing something I'd be curious what about my setup is so unique that it works fine for me. I'm not using docker, just building from source and booting it up from a service I setup. I have noticed that sometimes if I leave the page open too long I get a json error message, but refreshing or clicking the regenerate button works the second time. I'm not sure if this is a web socket problem though.

Good luck everyone, hope this helps some of you.

Edit: This is an excellent post for people using docker:
https://github.com/open-webui/open-webui/issues/8074#issuecomment-2562061337

<!-- gh-comment-id:2671224209 --> @XGhozt commented on GitHub (Feb 20, 2025): I'm surprised this issue is still on-going. The ironic part is most of you here could post your config to your local AI and have it update it for you. I was able to update [my config](https://github.com/open-webui/open-webui/issues/8074#issuecomment-2616843550) and pass the websocket packets on through my reverse proxy. There isn't really anything openwebui needs to do here. There isn't one answer for everyone because it depends on your environment. Apache, nginx, caddy, cloudflare, ssl vs non-ssl, domain or sub domain, etc... (An aside with cloudflare, you have to actually [enabled it](https://developers.cloudflare.com/network/websockets/) first). On my servers I'm using apache with let's encrypt for the SSL cert. I posted my apache config earlier. Below is a rough example, you can use this to google/search the rest or use AI to assist in building the config for your own setup. You're adding support for websockets, you must have any related modules for your website enabled and installed (most likely you already have them by default). The below would be part of your config specifically for the web socket connection. We just need the "/ws/socket.io" to connect, you don't need web sockets setup at the root of the config. For **apache**, you need something like this: ``` <IfModule mod_ssl.c> <VirtualHost *:443> ServerName ai.server.com ErrorLog logs/ai.server.com-error_log CustomLog logs/ai.server.com-access_log combined ProxyPreserveHost On ProxyPass /.well-known ! ProxyPass "/ws/socket.io/" "ws://localhost:8080/ws/socket.io/" ProxyPassReverse "/ws/socket.io/" "ws://localhost:8080/ws/socket.io/" ProxyPass "/" "http://localhost:8080/" ProxyPassReverse "/" "http://localhost:8080/" SSLCertificateFile /etc/letsencrypt/live/ai.server.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/ai.server.com/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf </VirtualHost> </IfModule> ``` The **nginx** equivalent this this is something like: ``` server { listen 443 ssl; server_name ai.server.com; ssl_certificate /etc/letsencrypt/live/ai.server.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/ai.server.com/privkey.pem; location /.well-known/ { # ... } location /ws/socket.io/ { proxy_pass http://localhost:8080/ws/socket.io/; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; } location / { proxy_pass http://localhost:8080/; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } ``` For caddy: ``` ai.server.com { tls /etc/letsencrypt/live/ai.server.com/fullchain.pem /etc/letsencrypt/live/ai.server.com/privkey.pem @socketio { path /ws/socket.io/* } reverse_proxy @socketio ws://localhost:8080/ws/socket.io/ reverse_proxy / http://localhost:8080/ } ``` Side notes; If I am missing something I'd be curious what about my setup is so unique that it works fine for me. I'm not using docker, just building from source and booting it up from a service I setup. I have noticed that sometimes if I leave the page open too long I get a json error message, but refreshing or clicking the regenerate button works the second time. I'm not sure if this is a web socket problem though. Good luck everyone, hope this helps some of you. Edit: This is an excellent post for people using docker: [https://github.com/open-webui/open-webui/issues/8074#issuecomment-2562061337](https://github.com/open-webui/open-webui/issues/8074#issuecomment-2562061337)
Author
Owner

@firestrife23 commented on GitHub (Feb 20, 2025):

@XGhozt thank you for the suggestions, I will definitely give it a try. I have not updated since 0.47 and hopefully it should be fixed, if not I will just add an environment to disable websocket on the openweb-ui container.

<!-- gh-comment-id:2671697839 --> @firestrife23 commented on GitHub (Feb 20, 2025): @XGhozt thank you for the suggestions, I will definitely give it a try. I have not updated since 0.47 and hopefully it should be fixed, if not I will just add an environment to disable websocket on the openweb-ui container.
Author
Owner

@ciprianveg commented on GitHub (Feb 20, 2025):

Is there an env var to disable ws?

<!-- gh-comment-id:2671985192 --> @ciprianveg commented on GitHub (Feb 20, 2025): Is there an env var to disable ws?
Author
Owner

@nyawox commented on GitHub (Feb 20, 2025):

alright, please ignore the nonsense i posted above. i figured out either caddy or firefox was having connectivity issue with websocket over http/2. apparently safari don't support websocket over http/2 and fallback to http/1.1 which explains why i didn't face this issue there. all i had to do is, just enable quic or disable http/2. that's it. nothing to do with the project, but i wanted to correct.

<!-- gh-comment-id:2672764356 --> @nyawox commented on GitHub (Feb 20, 2025): alright, please ignore the nonsense i posted above. i figured out either caddy or firefox was having connectivity issue with websocket over http/2. apparently safari don't support websocket over http/2 and fallback to http/1.1 which explains why i didn't face this issue there. all i had to do is, just enable quic or disable http/2. that's it. nothing to do with the project, but i wanted to correct.
Author
Owner

@likeablob commented on GitHub (Feb 21, 2025):

Just for anyone else running into this, in my case, the problem probably stems from a bug in Brave: https://github.com/brave/brave-browser/issues/15410

For the SyntaxError: Unexpected token... error, when session_id: $socket?.id becomes undefined because of an unconnected WS, POST /api/chat/completions responds with content-type: text/event-stream, and thus res.json() fails. So, perhaps an appropriate fallback would be nice?

<!-- gh-comment-id:2674713531 --> @likeablob commented on GitHub (Feb 21, 2025): Just for anyone else running into this, in my case, the problem probably stems from a bug in Brave: https://github.com/brave/brave-browser/issues/15410 For the `SyntaxError: Unexpected token...` error, when [`session_id: $socket?.id`](https://github.com/open-webui/open-webui/blob/6fedd72e3973e1d13c9daf540350cd822826bf27/src/lib/components/chat/Chat.svelte#L1581) becomes `undefined` because of an unconnected WS, `POST /api/chat/completions` responds with `content-type: text/event-stream`, and thus [`res.json()`](https://github.com/open-webui/open-webui/blob/6fedd72e3973e1d13c9daf540350cd822826bf27/src/lib/apis/openai/index.ts#L58) fails. So, perhaps an appropriate fallback would be nice?
Author
Owner

@Cnily03 commented on GitHub (Feb 25, 2025):

Same problem met here.

For nginx, we need to support websocket. it's easy to resolve it by googling:

map $http_upgrade $connection_upgrade {
    default keep-alive;
    'websocket' upgrade;
    '' close;
}
server {
    location / {
        ...
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

I met this issue when hosting CDN. we have to ensure that the cdn can process websocket request properly. maybe disable http/2 is a good try as websocket is only for http 1.1.

<!-- gh-comment-id:2681945894 --> @Cnily03 commented on GitHub (Feb 25, 2025): Same problem met here. For nginx, we need to support websocket. it's easy to resolve it by googling: ``` map $http_upgrade $connection_upgrade { default keep-alive; 'websocket' upgrade; '' close; } server { location / { ... proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; } } ``` I met this issue when hosting CDN. we have to ensure that the cdn can process websocket request properly. maybe disable http/2 is a good try as websocket is only for http 1.1.
Author
Owner

@jaapdh commented on GitHub (Feb 27, 2025):

Thanks to @tjbck for your hint; I was able to fix this. Basically, I am using Apache on my server as a proxy to my Docker container, and I had the following lines:

ProxyPass / http://127.0.0.1:5598/
ProxyPassReverse / http://127.0.0.1:5598/

I simply changed them to:

ProxyPass / http://127.0.0.1:5598/
ProxyPassReverse / http://127.0.0.1:5598/
<Location />       
    ProxyPass ws://localhost:5598/
    ProxyPassReverse ws://localhost:5598/
</Location>

PROOF: Screenshot 2024-12-25 235127

For now everything is working fine!

In our case we also needed to enable the mod_proxy_wstunnel in Apache before this would work.

<!-- gh-comment-id:2688359920 --> @jaapdh commented on GitHub (Feb 27, 2025): > Thanks to [@tjbck](https://github.com/tjbck) for your hint; I was able to fix this. Basically, I am using Apache on my server as a proxy to my Docker container, and I had the following lines: > > ``` > ProxyPass / http://127.0.0.1:5598/ > ProxyPassReverse / http://127.0.0.1:5598/ > ``` > > I simply changed them to: > > ``` > ProxyPass / http://127.0.0.1:5598/ > ProxyPassReverse / http://127.0.0.1:5598/ > <Location /> > ProxyPass ws://localhost:5598/ > ProxyPassReverse ws://localhost:5598/ > </Location> > ``` > > PROOF: ![Screenshot 2024-12-25 235127](https://github.com/user-attachments/assets/f4a3b15e-b24e-44a6-941b-742aefd5bc22) > > For now everything is working fine! In our case we also needed to enable the mod_proxy_wstunnel in Apache before this would work.
Author
Owner

@mcfool12 commented on GitHub (Feb 27, 2025):

Having no luck on NPM with the .5.x versions. I have gone through the above posts and following some of them, no matter what it will work for a question or two before it just spins and gives the error "SyntaxError: Unexpected token '<', "<html> <h"... is not valid JSON". I am wondering if anyone else on NPM has gotten it to be stable. The attached photos show the error in the search and then the config in NPM. I was testing with the second and third pic when I noticed the message at the bottom of the advanced tab "Please note, that any add_header or set_header directives added here will not be used by nginx. You will have to add a custom location '/' and add the header in the custom config there." and moved it under a secondary location of /.

Aside from that when I am able to directly connect via IP, the direct connection method to the server hosting the LM is working as expected and does not freeze up/break. That leads into the next issue though where it has been throwing up 500: Internal Error now with a direct connection and only loading when going through NPM. It was working fine yesterday and appears to have broken after updating to 0.5.17.

Edit. Just failed back to 0.5.16 and can confirm local connection, ie connecting at ip:port, is working again along with being able to access behind NPM. It is still answering only a few questions before failing.

Image
Image
Image
Image

<!-- gh-comment-id:2688878068 --> @mcfool12 commented on GitHub (Feb 27, 2025): Having no luck on NPM with the .5.x versions. I have gone through the above posts and following some of them, no matter what it will work for a question or two before it just spins and gives the error "SyntaxError: Unexpected token '<', "<html> <h"... is not valid JSON". I am wondering if anyone else on NPM has gotten it to be stable. The attached photos show the error in the search and then the config in NPM. I was testing with the second and third pic when I noticed the message at the bottom of the advanced tab "Please note, that any add_header or set_header directives added here will not be used by nginx. You will have to add a custom location '/' and add the header in the custom config there." and moved it under a secondary location of /. Aside from that when I am able to directly connect via IP, the direct connection method to the server hosting the LM is working as expected and does not freeze up/break. That leads into the next issue though where it has been throwing up 500: Internal Error now with a direct connection and only loading when going through NPM. It was working fine yesterday and appears to have broken after updating to 0.5.17. Edit. Just failed back to 0.5.16 and can confirm local connection, ie connecting at ip:port, is working again along with being able to access behind NPM. It is still answering only a few questions before failing. ![Image](https://github.com/user-attachments/assets/b3500ebc-c685-4899-ad7e-1900dd9da3b7) ![Image](https://github.com/user-attachments/assets/1d89514f-32b2-4f2b-9e0a-7fb9596742e6) ![Image](https://github.com/user-attachments/assets/62d4fb30-c47e-47ae-a89c-51ff44905055) ![Image](https://github.com/user-attachments/assets/a2306407-38b7-4309-ad0b-2e93a51e1dc8)
Author
Owner

@FreakErn commented on GitHub (Feb 28, 2025):

For everyone trying this with ISPConfig and Apache2. Do not use the ISPConfig menu option to configure the reverse proxy. Instead use the suggestion from @Simi5599. in Apache Directives

ProxyPass / http://127.0.0.1:5598/
ProxyPassReverse / http://127.0.0.1:5598/
<Location />       
    ProxyPass ws://localhost:5598/
    ProxyPassReverse ws://localhost:5598/
</Location>

If you still want your letsencrypt to work you might have to exclude .well-known from the proxy with something like this:

RewriteEngine on
RewriteRule ^/\.well-known.* - [E=no-proxy:1]
RewriteCond %{ENV:REDIRECT_no-proxy} .+
RewriteRule .* - [E=no-proxy:1]

A simple ProxyPass /.well-known ! didn't work for me.

I moved the http ProxyPass into the location so my entire Apache-Directives look like this:

RewriteEngine on
RewriteRule ^/\.well-known.* - [E=no-proxy:1]
RewriteCond %{ENV:REDIRECT_no-proxy} .+
RewriteRule .* - [E=no-proxy:1]

<Location />
  ProxyPass http://localhost:3000/
  ProxyPassReverse http://localhost:3000/
  ProxyPass ws://localhost:3000/
  ProxyPassReverse ws://localhost:3000/
</Location>
<!-- gh-comment-id:2690512588 --> @FreakErn commented on GitHub (Feb 28, 2025): For everyone trying this with ISPConfig and Apache2. Do not use the ISPConfig menu option to configure the reverse proxy. Instead use the suggestion from @Simi5599. in Apache Directives > ``` > ProxyPass / http://127.0.0.1:5598/ > ProxyPassReverse / http://127.0.0.1:5598/ > <Location /> > ProxyPass ws://localhost:5598/ > ProxyPassReverse ws://localhost:5598/ > </Location> > ``` If you still want your letsencrypt to work you might have to exclude .well-known from the proxy with something like this: ``` RewriteEngine on RewriteRule ^/\.well-known.* - [E=no-proxy:1] RewriteCond %{ENV:REDIRECT_no-proxy} .+ RewriteRule .* - [E=no-proxy:1] ``` A simple `ProxyPass /.well-known !` didn't work for me. I moved the http ProxyPass into the location so my entire Apache-Directives look like this: ``` RewriteEngine on RewriteRule ^/\.well-known.* - [E=no-proxy:1] RewriteCond %{ENV:REDIRECT_no-proxy} .+ RewriteRule .* - [E=no-proxy:1] <Location /> ProxyPass http://localhost:3000/ ProxyPassReverse http://localhost:3000/ ProxyPass ws://localhost:3000/ ProxyPassReverse ws://localhost:3000/ </Location> ```
Author
Owner

@junjieyuan commented on GitHub (Mar 7, 2025):

If you enable http/https proxy for open webui backend (in container), it will makes nginx proxy_pass fail and return 502, please disable http/https proxy for open webui.

My nginx config, it works:

map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
}

server {
        listen 443 ssl;
        http2 on;

        server_name chat.example.com;

        gzip on;
        gzip_types application/atom+xml application/geo+json application/javascript application/x-javascript application/json application/ld+json application/manifest+json application/rdf+xml application/rss+xml application/vnd.ms-fontobject application/wasm application/x-web-app-manifest+json application/xhtml+xml application/xml font/eot font/otf font/ttf image/bmp image/svg+xml image/vnd.microsoft.icon image/x-icon text/cache-manifest text/calendar text/css text/javascript text/markdown text/plain text/xml text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

        ssl_protocols TLSv1.3;
        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        location / {
                proxy_pass http://localhost:3000;

                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

                # Add WebSocket support
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection $connection_upgrade;
        }
}
<!-- gh-comment-id:2705474259 --> @junjieyuan commented on GitHub (Mar 7, 2025): If you enable http/https proxy for open webui backend (in container), it will makes nginx proxy_pass fail and return 502, please disable http/https proxy for open webui. My nginx config, it works: ```text map $http_upgrade $connection_upgrade { default upgrade; '' close; } server { listen 443 ssl; http2 on; server_name chat.example.com; gzip on; gzip_types application/atom+xml application/geo+json application/javascript application/x-javascript application/json application/ld+json application/manifest+json application/rdf+xml application/rss+xml application/vnd.ms-fontobject application/wasm application/x-web-app-manifest+json application/xhtml+xml application/xml font/eot font/otf font/ttf image/bmp image/svg+xml image/vnd.microsoft.icon image/x-icon text/cache-manifest text/calendar text/css text/javascript text/markdown text/plain text/xml text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; ssl_protocols TLSv1.3; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; location / { proxy_pass http://localhost:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # Add WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; } } ```
Author
Owner

@pnjacket commented on GitHub (Mar 7, 2025):

I have been having weird issues with WS not working correctly for days and finally figured out.
In my case, it was something to do with DNS records returning external ipv6 address that is not accessible from my internal network.
Assuming my open webui server has the domain name 'chat.mydomain.com', and the name was served by my local DNS server, but my dns server is only designed to server ipv4. All ipv6 requests were forwarded to the external dns server. I have exposed my open webui to the internet through cloud tunnel, which added a random ipv4 and ipv6 addresses to the cloud providers tunnel server.
When I am using it in the local network, it is trying to work with v6 address and timing out.
To prevent from v6 address to be resolved when I am in the local, I had to create a dummy dns record pointing to the internal reverse proxy address and add CNAME record which directs 'chat.mydomain.com' to the dummy one. That solved my specific issue. No fancy settings in nginx, just three lines to enable websocket.
I hope this will help someone.

<!-- gh-comment-id:2705522267 --> @pnjacket commented on GitHub (Mar 7, 2025): I have been having weird issues with WS not working correctly for days and finally figured out. In my case, it was something to do with DNS records returning external ipv6 address that is not accessible from my internal network. Assuming my open webui server has the domain name 'chat.mydomain.com', and the name was served by my local DNS server, but my dns server is only designed to server ipv4. All ipv6 requests were forwarded to the external dns server. I have exposed my open webui to the internet through cloud tunnel, which added a random ipv4 and ipv6 addresses to the cloud providers tunnel server. When I am using it in the local network, it is trying to work with v6 address and timing out. To prevent from v6 address to be resolved when I am in the local, I had to create a dummy dns record pointing to the internal reverse proxy address and add CNAME record which directs 'chat.mydomain.com' to the dummy one. That solved my specific issue. No fancy settings in nginx, just three lines to enable websocket. I hope this will help someone.
Author
Owner

@mcfool12 commented on GitHub (Mar 8, 2025):

I have figured out the issue I was running into. I had forgotten to mention that I was hosting the LLM through LM Studio on another machine. After updating the NGINX config in NPM to allow for WebSockets it was working but then would break after 1 - 3 questions. This was due to a CORS issue in modern browsers not working over ws and requiring wss. With this I created another proxy pointing to the ip of the server hosting LM Studio. With that made and https enabled with a cert, I updated the server address in Open WebUI and used https. No more CORS errors and chats will run on as long as needed.

NGINX config for the proxy pointing to OpenWebUI (Will not paste properly into code format for some reason)

location / {
proxy_pass http://openwebui:8080/;

# Enable WebSockets
#proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";

# Preserve original headers
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;

# Ensure WebSockets are handled securely
proxy_set_header Access-Control-Allow-Origin *;
proxy_set_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
proxy_set_header Access-Control-Allow-Headers "Authorization, Content-Type";
proxy_set_header Access-Control-Allow-Credentials true;

}

NGINX config for the proxy pointing to LM Studio Server

location / { proxy_pass http://lmsutdio:12345/; rewrite ^/(models.*)$ /api/v0/$1 break; }
and

location /api/v0/ {
proxy_pass http://lmstudio:12345/; # LM Studio backend (HTTP only)

# Enable WebSockets
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";

# Preserve original headers
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;

# Ensure WebSockets are handled securely
proxy_set_header Access-Control-Allow-Origin *;
proxy_set_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
proxy_set_header Access-Control-Allow-Headers "Authorization, Content-Type";
proxy_set_header Access-Control-Allow-Credentials true;

}

With the HTTPS connection made to cover CORS over WSS, it is now working. The connection in Open WebUI, like I said earlier, is now https instead of http and the path is now just /v1 instead of /api/v0 or /api/v1. The direct connection method is also working should there be an issue with the routed connection method in the future which is nice. Now to test with some onboarded users.

<!-- gh-comment-id:2708466387 --> @mcfool12 commented on GitHub (Mar 8, 2025): I have figured out the issue I was running into. I had forgotten to mention that I was hosting the LLM through LM Studio on another machine. After updating the NGINX config in NPM to allow for WebSockets it was working but then would break after 1 - 3 questions. This was due to a CORS issue in modern browsers not working over ws and requiring wss. With this I created another proxy pointing to the ip of the server hosting LM Studio. With that made and https enabled with a cert, I updated the server address in Open WebUI and used https. No more CORS errors and chats will run on as long as needed. NGINX config for the proxy pointing to OpenWebUI (Will not paste properly into code format for some reason) location / { proxy_pass http://openwebui:8080/; # Enable WebSockets #proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; # Preserve original headers proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; # Ensure WebSockets are handled securely proxy_set_header Access-Control-Allow-Origin *; proxy_set_header Access-Control-Allow-Methods "GET, POST, OPTIONS"; proxy_set_header Access-Control-Allow-Headers "Authorization, Content-Type"; proxy_set_header Access-Control-Allow-Credentials true; } NGINX config for the proxy pointing to LM Studio Server `location / { proxy_pass http://lmsutdio:12345/; rewrite ^/(models.*)$ /api/v0/$1 break; } ` and location /api/v0/ { proxy_pass http://lmstudio:12345/; # LM Studio backend (HTTP only) # Enable WebSockets proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; # Preserve original headers proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; # Ensure WebSockets are handled securely proxy_set_header Access-Control-Allow-Origin *; proxy_set_header Access-Control-Allow-Methods "GET, POST, OPTIONS"; proxy_set_header Access-Control-Allow-Headers "Authorization, Content-Type"; proxy_set_header Access-Control-Allow-Credentials true; } With the HTTPS connection made to cover CORS over WSS, it is now working. The connection in Open WebUI, like I said earlier, is now https instead of http and the path is now just /v1 instead of /api/v0 or /api/v1. The direct connection method is also working should there be an issue with the routed connection method in the future which is nice. Now to test with some onboarded users.
Author
Owner

@readonly-git-velsof commented on GitHub (Mar 10, 2025):

For me this solution worked. Definitely the help from the answers above is the reason for this solution:

How to Fix WebSocket Issues with Open WebUI Behind Apache Proxy

I was having issues with WebSocket connections (seeing errors like "WebSocket connection failed" and "Network Problem" in the browser console). Here's the solution that worked for me:

Step 1: Enable Required Apache Modules

sudo a2enmod proxy proxy_http proxy_wstunnel ssl headers

Step 2: Update Apache Virtual Host Configuration

<VirtualHost *:443>
    ServerName your-domain.com
    
    SSLEngine On
    SSLCertificateFile /path/to/fullchain.pem
    SSLCertificateKeyFile /path/to/privkey.pem
    
    # Enable SSL for proxy connections
    SSLProxyEngine On
    SSLProxyVerify none
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    
    # Increase timeouts for AI requests
    ProxyTimeout 600
    Timeout 600
    
    # Standard HTTP proxying
    ProxyPass / http://localhost:3000/
    ProxyPassReverse / http://localhost:3000/
    
    # THE KEY FIX: Add WebSocket support to the root location
    <Location />
        ProxyPass ws://localhost:3000/
        ProxyPassReverse ws://localhost:3000/
    </Location>
    
    # Headers for proper proxying
    RequestHeader set Host "your-domain.com"
    RequestHeader set X-Real-IP "%{REMOTE_ADDR}s"
    RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"
    RequestHeader set X-Forwarded-Proto "https"
    
    <Proxy *>
        Require all granted
    </Proxy>
    
    # Logging
    ErrorLog ${APACHE_LOG_DIR}/openwebui-error.log
    CustomLog ${APACHE_LOG_DIR}/openwebui-access.log combined
</VirtualHost>

Step 3: Restart Apache

sudo apache2ctl configtest
sudo systemctl restart apache2

Step 4: Update Docker Compose Configuration (if needed)

Make sure your docker-compose.yml includes these settings:

version: '3'
services:
  open-webui:
    # ... other settings ...
    environment:
      # ... other environment variables ...
      - OLLAMA_ORIGINS=https://your-domain.com,http://localhost:3000
      # CORS settings for WebSocket support
      - CORS_ALLOW_ORIGIN=*
      - CORS_ALLOW_CREDENTIALS=true
    # ... other settings ...

The key fix is adding both regular HTTP proxying and WebSocket proxying for the same root location. This ensures that the WebSocket connections used by Open WebUI for real-time communication work properly through the Apache proxy.

After making these changes, you may need to clear your browser cache or try in an incognito window.

<!-- gh-comment-id:2710492043 --> @readonly-git-velsof commented on GitHub (Mar 10, 2025): ### For me this solution worked. Definitely the help from the answers above is the reason for this solution: # How to Fix WebSocket Issues with Open WebUI Behind Apache Proxy I was having issues with WebSocket connections (seeing errors like "WebSocket connection failed" and "Network Problem" in the browser console). Here's the solution that worked for me: ## Step 1: Enable Required Apache Modules ```bash sudo a2enmod proxy proxy_http proxy_wstunnel ssl headers ``` ## Step 2: Update Apache Virtual Host Configuration ```apache <VirtualHost *:443> ServerName your-domain.com SSLEngine On SSLCertificateFile /path/to/fullchain.pem SSLCertificateKeyFile /path/to/privkey.pem # Enable SSL for proxy connections SSLProxyEngine On SSLProxyVerify none SSLProxyCheckPeerCN off SSLProxyCheckPeerName off # Increase timeouts for AI requests ProxyTimeout 600 Timeout 600 # Standard HTTP proxying ProxyPass / http://localhost:3000/ ProxyPassReverse / http://localhost:3000/ # THE KEY FIX: Add WebSocket support to the root location <Location /> ProxyPass ws://localhost:3000/ ProxyPassReverse ws://localhost:3000/ </Location> # Headers for proper proxying RequestHeader set Host "your-domain.com" RequestHeader set X-Real-IP "%{REMOTE_ADDR}s" RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s" RequestHeader set X-Forwarded-Proto "https" <Proxy *> Require all granted </Proxy> # Logging ErrorLog ${APACHE_LOG_DIR}/openwebui-error.log CustomLog ${APACHE_LOG_DIR}/openwebui-access.log combined </VirtualHost> ``` ## Step 3: Restart Apache ```bash sudo apache2ctl configtest sudo systemctl restart apache2 ``` ## Step 4: Update Docker Compose Configuration (if needed) Make sure your docker-compose.yml includes these settings: ```yaml version: '3' services: open-webui: # ... other settings ... environment: # ... other environment variables ... - OLLAMA_ORIGINS=https://your-domain.com,http://localhost:3000 # CORS settings for WebSocket support - CORS_ALLOW_ORIGIN=* - CORS_ALLOW_CREDENTIALS=true # ... other settings ... ``` The key fix is adding both regular HTTP proxying and WebSocket proxying for the same root location. This ensures that the WebSocket connections used by Open WebUI for real-time communication work properly through the Apache proxy. After making these changes, you may need to clear your browser cache or try in an incognito window.
Author
Owner

@firestrife23 commented on GitHub (Mar 10, 2025):

LOL, regurgitating ChatGPT solution... Sorry, Apache just makes me vomit too.

<!-- gh-comment-id:2710602446 --> @firestrife23 commented on GitHub (Mar 10, 2025): LOL, regurgitating ChatGPT solution... Sorry, Apache just makes me vomit too.
Author
Owner

@Someguitarist commented on GitHub (Mar 10, 2025):

I'm sorry, I'm way to dumb for this. I've been trying all week to get this to work with Nginx Proxy Manager and copy and pasting all kinds of things listed above, plus more Googling and ChatGPT to figure this out. I have 'Enable Web Sockets' selected and tried setting custom location stuff based on the above but I still get "SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data" when accessed through reverse proxy, but not when accessed locally.

Can someone please put simple instructions for the idiots like me for how to access via reverse proxy with NPM? Literally every other self hosted app I have works and this worked great before the V5 upgrade. For now I'm going to roll back to an earlier version or move to something else, but I'd really like to get this resolved.

<!-- gh-comment-id:2710644255 --> @Someguitarist commented on GitHub (Mar 10, 2025): I'm sorry, I'm way to dumb for this. I've been trying all week to get this to work with Nginx Proxy Manager and copy and pasting all kinds of things listed above, plus more Googling and ChatGPT to figure this out. I have 'Enable Web Sockets' selected and tried setting custom location stuff based on the above but I still get "SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data" when accessed through reverse proxy, but not when accessed locally. Can someone *please* put simple instructions for the idiots like me for how to access via reverse proxy with NPM? Literally every other self hosted app I have works and this worked great before the V5 upgrade. For now I'm going to roll back to an earlier version or move to something else, but I'd really like to get this resolved.
Author
Owner

@mcfool12 commented on GitHub (Mar 10, 2025):

@Someguitarist Post what your current config is and someone might be able to get it for ya. If you are hosting the LLM on a seperate machine, you can see my post a few up on how to configure NPM for Open WebUI and then also the LLM host. In my case it is coming from LM Studio but would work for others if they are passing traffic over WS/HTTP instead of WSS/HTTPS.

<!-- gh-comment-id:2710837433 --> @mcfool12 commented on GitHub (Mar 10, 2025): @Someguitarist Post what your current config is and someone might be able to get it for ya. If you are hosting the LLM on a seperate machine, you can see my post a few up on how to configure NPM for Open WebUI and then also the LLM host. In my case it is coming from LM Studio but would work for others if they are passing traffic over WS/HTTP instead of WSS/HTTPS.
Author
Owner

@Someguitarist commented on GitHub (Mar 10, 2025):

Thanks! I just figured it out. I forgot I had it behind Authentik as a reverse proxy. Removing that, and now it works. I guess I could just use the SSO feature instead of reverse proxying it. But works now!

<!-- gh-comment-id:2711137864 --> @Someguitarist commented on GitHub (Mar 10, 2025): Thanks! I just figured it out. I forgot I had it behind Authentik as a reverse proxy. Removing that, and now it works. I guess I could just use the SSO feature instead of reverse proxying it. But works now!
Author
Owner

@vood commented on GitHub (Mar 11, 2025):

For anyone struggling to run on localhost with open-webui serve, make sure you try both http://127.0.0.1:8080 and http://localhost:8080. For the the former worked while the latter didn't.

<!-- gh-comment-id:2712247283 --> @vood commented on GitHub (Mar 11, 2025): For anyone struggling to run on localhost with `open-webui serve`, make sure you try both `http://127.0.0.1:8080` and `http://localhost:8080`. For the the former worked while the latter didn't.
Author
Owner

@TurboTechieSystems commented on GitHub (Mar 16, 2025):

Does anyone know how to fix this when using IIS as a reverse proxy? Been trying to get this working for a few days now. Open-WebUI works fine locally and using static IP address's. We unfortunately use IIS as the reverse proxy server for our applications. The site is ssl enabled through lets encrypt. Security certificate works just fine and Open-WebUI loads just fine. Only problem is when submitting a chat get the same error as everyone else about json parse error.
I have noticed that instead of returning a JSON for the completions, data is returned as a stream-event instead. This only happens when accessing through the IIS proxy and not through direct IP address.
Web-Sockets are setup and appear to be working as shown.
Am I missing something or does anyone have an idea on how to get this working with IIS as a reverse proxy.
By the way using Cortex as my LLM server that is also proxied through IIS and works just fine when connecting to Open-WebUI via local or static IP. Using Automatic1111 as my image generator and works fine through IIS proxy when connecting to Open-WebUI via local or static IP.
Logs in Cortex show that Cortex receives the request and processes it and provides a response as it should.
So simply put I have Cortex, Open-WebUI, and Automatic1111 as seperete services on a Ubuntu machine. All three are Proxied and secured with SSL through IIS. Using Open-WebUI over the local or static IP works just fine with Cortex and Automatic1111 responding properly over https domain name and SSL. Open-WebUI is the issue.

Image

Image

<!-- gh-comment-id:2727166240 --> @TurboTechieSystems commented on GitHub (Mar 16, 2025): Does anyone know how to fix this when using IIS as a reverse proxy? Been trying to get this working for a few days now. Open-WebUI works fine locally and using static IP address's. We unfortunately use IIS as the reverse proxy server for our applications. The site is ssl enabled through lets encrypt. Security certificate works just fine and Open-WebUI loads just fine. Only problem is when submitting a chat get the same error as everyone else about json parse error. I have noticed that instead of returning a JSON for the completions, data is returned as a stream-event instead. This only happens when accessing through the IIS proxy and not through direct IP address. Web-Sockets are setup and appear to be working as shown. Am I missing something or does anyone have an idea on how to get this working with IIS as a reverse proxy. By the way using Cortex as my LLM server that is also proxied through IIS and works just fine when connecting to Open-WebUI via local or static IP. Using Automatic1111 as my image generator and works fine through IIS proxy when connecting to Open-WebUI via local or static IP. Logs in Cortex show that Cortex receives the request and processes it and provides a response as it should. So simply put I have Cortex, Open-WebUI, and Automatic1111 as seperete services on a Ubuntu machine. All three are Proxied and secured with SSL through IIS. Using Open-WebUI over the local or static IP works just fine with Cortex and Automatic1111 responding properly over https domain name and SSL. Open-WebUI is the issue. ![Image](https://github.com/user-attachments/assets/60a04f7a-559a-44f1-a045-7eed7566b431) ![Image](https://github.com/user-attachments/assets/2ab9a80b-d155-42d6-a6f9-ebe0e7865eef)
Author
Owner

@Eisaichen commented on GitHub (Mar 19, 2025):

Glad to see ENABLE_WEBSOCKET_SUPPORT is now set to False by default. Enabling WebSocket without proper preparation is really easy to bring down the service.
I believe many people put their servers behind Cloudflare, and if they are free-tier users, Cloudflare has a very limited quota for WebSocket connections. Because of that, even if they configured their reverse proxy correctly, they can still be experiencing fail to connect or unstable service. When v0.5.0 first came out, I had to expose my server from Cloudflare to make it work again.

<!-- gh-comment-id:2735034377 --> @Eisaichen commented on GitHub (Mar 19, 2025): Glad to see `ENABLE_WEBSOCKET_SUPPORT` is now set to `False` by default. Enabling WebSocket without proper preparation is really easy to bring down the service. I believe many people put their servers behind Cloudflare, and if they are free-tier users, Cloudflare has a very limited quota for WebSocket connections. Because of that, even if they configured their reverse proxy correctly, they can still be experiencing fail to connect or unstable service. When [v0.5.0](https://github.com/open-webui/open-webui/releases/tag/v0.5.0) first came out, I had to expose my server from Cloudflare to make it work again.
Author
Owner

@spammenotinoz commented on GitHub (Mar 21, 2025):

Related: #8073

As mentioned in the changelogs, you need a proper websocket support going forward with 0.5.0+

I'll make a educated guess here and say you have a network misconfiguration (most likely your reverse proxy) that's blocking the webui from properly communicating with the backend. You'll notice without the reverse proxy, the webui will work as intended (let me know if this is not the case for you). The recommended course of action would be to ask questions directly in the respective reverse proxy community.

Keep us updated with your troubleshooting journey!

Update

If you directly access the webui via localhost, you should not encounter this issue.

Understood, but over the internet that is pretty much impossible. The way around is to implement keep-alives, the current implementation stops keep-alives during the streaming phase.
Without proper keep-alives, if either the user or server uses Cloudflare as an example then this issue exists during any pause "eg: large image upload, thinking response, backend llm delay"

<!-- gh-comment-id:2742018518 --> @spammenotinoz commented on GitHub (Mar 21, 2025): > Related: [#8073](https://github.com/open-webui/open-webui/discussions/8073) > > As mentioned in the changelogs, you need a proper websocket support going forward with 0.5.0+ > > I'll make a educated guess here and say you have a network misconfiguration (most likely your reverse proxy) that's blocking the webui from properly communicating with the backend. You'll notice **without the reverse proxy,** the webui **will work** as intended (let me know if this is not the case for you). The recommended course of action would be to ask questions directly in the respective reverse proxy community. > > Keep us updated with your troubleshooting journey! > > # Update > If you directly access the webui via localhost, you should not encounter this issue. Understood, but over the internet that is pretty much impossible. The way around is to implement keep-alives, the current implementation stops keep-alives during the streaming phase. Without proper keep-alives, if either the user or server uses Cloudflare as an example then this issue exists during any pause "eg: large image upload, thinking response, backend llm delay"
Author
Owner

@spammenotinoz commented on GitHub (Mar 21, 2025):

Glad to see ENABLE_WEBSOCKET_SUPPORT is now set to False by default. Enabling WebSocket without proper preparation is really easy to bring down the service. I believe many people put their servers behind Cloudflare, and if they are free-tier users, Cloudflare has a very limited quota for WebSocket connections. Because of that, even if they configured their reverse proxy correctly, they can still be experiencing fail to connect or unstable service. When v0.5.0 first came out, I had to expose my server from Cloudflare to make it work again.

True but also don't forget the client. Cloudflare has a timeout of 100 seconds, which is actually higher than many other providers\network devices. Remember every single network device, service, proxy, firewall from the client to the server will need a much longer timeout period say 5-7minutes to support some of the thinking models. Realistically that's not going to happen, so another approach would be required.

<!-- gh-comment-id:2742021377 --> @spammenotinoz commented on GitHub (Mar 21, 2025): > Glad to see `ENABLE_WEBSOCKET_SUPPORT` is now set to `False` by default. Enabling WebSocket without proper preparation is really easy to bring down the service. I believe many people put their servers behind Cloudflare, and if they are free-tier users, Cloudflare has a very limited quota for WebSocket connections. Because of that, even if they configured their reverse proxy correctly, they can still be experiencing fail to connect or unstable service. When [v0.5.0](https://github.com/open-webui/open-webui/releases/tag/v0.5.0) first came out, I had to expose my server from Cloudflare to make it work again. True but also don't forget the client. Cloudflare has a timeout of 100 seconds, which is actually higher than many other providers\network devices. Remember every single network device, service, proxy, firewall from the client to the server will need a much longer timeout period say 5-7minutes to support some of the thinking models. Realistically that's not going to happen, so another approach would be required.
Author
Owner

@Papierkorb commented on GitHub (Mar 24, 2025):

So I'm also having this issue and it caused me to not be able to use openwebui for months. It's hosted behind a traefik instance in my kubernetes cluster. I can see in the Network Tab that often times no websocket connection is even made, and after a while the UI complains that it received broken JSON.

However, the Playground works just fine. Also, when I access my models through their respective API endpoints directly they have no issue responding, with and without streaming.

Open-Webui isn't the only WebSocket-using application I host like this, but it's the only having issues. With ENABLE_WEBSOCKET_SUPPORT set to False it does work again, although I'd still prefer proper WebSocket support.

It did work after I cleared all caches and data of its domain. This isn't hosted behind/through any CDN, it's Computer -> LAN -> traefik -> open-webui. Traefik doesn't have special configuration, except for TLS.

<!-- gh-comment-id:2749100668 --> @Papierkorb commented on GitHub (Mar 24, 2025): So I'm also having this issue and it caused me to not be able to use openwebui for months. It's hosted behind a traefik instance in my kubernetes cluster. I can see in the Network Tab that often times no websocket connection is even made, and after a while the UI complains that it received broken JSON. However, the Playground works just fine. Also, when I access my models through their respective API endpoints directly they have no issue responding, with and without streaming. Open-Webui isn't the only WebSocket-using application I host like this, but it's the only having issues. With `ENABLE_WEBSOCKET_SUPPORT` set to `False` it does work again, although I'd still prefer proper WebSocket support. It did work after I cleared all caches and data of its domain. This isn't hosted behind/through any CDN, it's Computer -> LAN -> traefik -> open-webui. Traefik doesn't have special configuration, except for TLS.
Author
Owner

@firestrife23 commented on GitHub (Mar 24, 2025):

I use Traefik too. I'm wondering, do you have HTTP3 enabled on yours? Because I suspect it's HTTP3 since it only does WebSocket over QUIC protocol. Im not entirely sure that’s the culprit…. I’m still investigating too.

<!-- gh-comment-id:2749144073 --> @firestrife23 commented on GitHub (Mar 24, 2025): I use Traefik too. I'm wondering, do you have HTTP3 enabled on yours? Because I suspect it's HTTP3 since it only does WebSocket over QUIC protocol. Im not entirely sure that’s the culprit…. I’m still investigating too.
Author
Owner

@Papierkorb commented on GitHub (Mar 24, 2025):

@firestrife23
Just checked, it's using HTTP/2 - According to the Network dev tool and traefiks config. Maybe I'll try tomorrow if enabling HTTP/3 helps. I get from your comment that you have HTTP/3 enabled and are facing issues too?

<!-- gh-comment-id:2749151982 --> @Papierkorb commented on GitHub (Mar 24, 2025): @firestrife23 Just checked, it's using HTTP/2 - According to the Network dev tool and traefiks config. Maybe I'll try tomorrow if enabling HTTP/3 helps. I get from your comment that you have HTTP/3 enabled and are facing issues too?
Author
Owner

@zeus123456 commented on GitHub (Mar 24, 2025):

Here is my config with Nginx Proxy Manager which I switched to from nginx on my ubuntu wsl after the websockets requirement caused me issue (I suspect I did not need to switch and it might have just been caching issues as reported by others).

However, I did have some issues with another open webui version recently that caused calls to drop, turned out is was my ios beta version, so try testing your issue from other devices/browsers/etc. (I tried another iphone without beta),

Domain Names *
mydomain.com

http
Forward Hostname / IP*
192.168.my_private_IP
Forward Port *
8080

Websockets support (enabled)

Access List
Publicly Accessible

I did not enable http/2 and don't seem to have http/3 as an option (might need to upgrade)

<!-- gh-comment-id:2749183321 --> @zeus123456 commented on GitHub (Mar 24, 2025): Here is my config with Nginx Proxy Manager which I switched to from nginx on my ubuntu wsl after the websockets requirement caused me issue (I suspect I did not need to switch and it might have just been caching issues as reported by others). However, I did have some issues with another open webui version recently that caused calls to drop, turned out is was my ios beta version, so try testing your issue from other devices/browsers/etc. (I tried another iphone without beta), Domain Names * mydomain.com http Forward Hostname / IP* 192.168.my_private_IP Forward Port * 8080 Websockets support (enabled) Access List Publicly Accessible I did not enable http/2 and don't seem to have http/3 as an option (might need to upgrade)
Author
Owner

@ticpu commented on GitHub (Mar 24, 2025):

From what I understand from all of these comments with tips and tricks on how to fix this, I understand that the core issue is OpenWebUI assuming websocket connections can't fail, are always connected and have unlimited timeout. Which is only true on localhost.
I guess that's the real issue to address.
Maybe add keepalive, reconnections and a way to restore the state after failure?

<!-- gh-comment-id:2749521480 --> @ticpu commented on GitHub (Mar 24, 2025): From what I understand from all of these comments with tips and tricks on how to fix this, I understand that the core issue is OpenWebUI assuming websocket connections can't fail, are always connected and have unlimited timeout. Which is only true on localhost. I guess that's the real issue to address. Maybe add keepalive, reconnections and a way to restore the state after failure?
Author
Owner

@firestrife23 commented on GitHub (Mar 25, 2025):

@firestrife23 Just checked, it's using HTTP/2 - According to the Network dev tool and traefiks config. Maybe I'll try tomorrow if enabling HTTP/3 helps. I get from your comment that you have HTTP/3 enabled and are facing issues too?

More of hits and misses, most of the time it seems to work well. Whenever I get code 500, a hard reload with the browser usually makes it go away. It seems more noticeable with Safari than third-party browsers.

<!-- gh-comment-id:2749748859 --> @firestrife23 commented on GitHub (Mar 25, 2025): > [@firestrife23](https://github.com/firestrife23) Just checked, it's using HTTP/2 - According to the Network dev tool and traefiks config. Maybe I'll try tomorrow if enabling HTTP/3 helps. I get from your comment that you have HTTP/3 enabled and are facing issues too? More of hits and misses, most of the time it seems to work well. Whenever I get code 500, a hard reload with the browser usually makes it go away. It seems more noticeable with Safari than third-party browsers.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#118297