[PR #23570] [CLOSED] feat: allow optional auditing of GET requests via env flag (#23461) #130921

New Issue

2026-05-21T15:42:23-05:00

GiteaMirror commented

2026-05-21 15:42:23 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/23570
Author: @micheal000010000-hub
Created: 4/10/2026
Status: ❌ Closed

Base: dev ← Head: feat/audit-get-requests-23461

📝 Commits (1)

eee2922 feat: allow optional auditing of GET requests via env flag (#23461)

📊 Changes

2 files changed (+14 additions, -3 deletions)

View changed files

📝 .env.example (+4 -1)
📝 backend/open_webui/utils/audit.py (+10 -2)

📄 Description

Pull Request Checklist

Target branch: This PR targets the dev branch.
Description: Provided below.
Changelog: Added below.
Documentation: Added environment variable to .env.example.
Dependencies: No new dependencies added.
Testing: Manual testing performed (see below).
Agentic AI Code: Code has been reviewed and tested manually.
Code review: Self-reviewed for correctness and consistency.
Design & Architecture: Minimal change, no architectural impact.
Git Hygiene: Atomic PR with no unrelated changes.
Title Prefix: Uses feat.

Description

This PR adds support for auditing GET requests via an environment variable and fixes an issue where authentication endpoints were being skipped when using GET.

Previously, requests with method GET were skipped before reaching the auth endpoint logic, causing them to never be logged.

Changelog Entry

Description

Adds optional auditing for GET requests and fixes incorrect skipping of auth endpoints.

Added

New environment variable AUDIT_LOG_GET_REQUESTS to control auditing of GET requests.

Changed

Updated _should_skip_auditing logic to conditionally include GET requests.
Reordered logic to ensure auth endpoints are always audited.

Fixed

Fixed issue where auth endpoints (/api/v1/auths/*) were not logged when accessed via GET.

Additional Information

AUDIT_LOG_GET_REQUESTS=false (default): GET requests are skipped.
AUDIT_LOG_GET_REQUESTS=true: GET requests are included in audit logs.
No breaking changes introduced.

Testing

Verified authenticated API requests using /api/v1/models
Confirmed no regression in existing POST/PUT/PATCH/DELETE behavior
Verified logic correctness by ensuring request flow works as expected
Tested both configurations:
- AUDIT_LOG_GET_REQUESTS=false → GET requests skipped
- AUDIT_LOG_GET_REQUESTS=true → GET requests processed

Screenshots or Videos

N/A (backend logic change)

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/23570 **Author:** [@micheal000010000-hub](https://github.com/micheal000010000-hub) **Created:** 4/10/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `feat/audit-get-requests-23461` --- ### 📝 Commits (1) - [`eee2922`](https://github.com/open-webui/open-webui/commit/eee2922c90c0a41d0f77254400f6702ac2150f78) feat: allow optional auditing of GET requests via env flag (#23461) ### 📊 Changes **2 files changed** (+14 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `.env.example` (+4 -1) 📝 `backend/open_webui/utils/audit.py` (+10 -2) </details> ### 📄 Description  # Pull Request Checklist * [x] **Target branch:** This PR targets the `dev` branch. * [x] **Description:** Provided below. * [x] **Changelog:** Added below. * [x] **Documentation:** Added environment variable to `.env.example`. * [x] **Dependencies:** No new dependencies added. * [x] **Testing:** Manual testing performed (see below). * [x] **Agentic AI Code:** Code has been reviewed and tested manually. * [x] **Code review:** Self-reviewed for correctness and consistency. * [x] **Design & Architecture:** Minimal change, no architectural impact. * [x] **Git Hygiene:** Atomic PR with no unrelated changes. * [x] **Title Prefix:** Uses `feat`. --- # Description This PR adds support for auditing `GET` requests via an environment variable and fixes an issue where authentication endpoints were being skipped when using `GET`. Previously, requests with method `GET` were skipped before reaching the auth endpoint logic, causing them to never be logged. --- # Changelog Entry ### Description * Adds optional auditing for `GET` requests and fixes incorrect skipping of auth endpoints. ### Added * New environment variable `AUDIT_LOG_GET_REQUESTS` to control auditing of `GET` requests. ### Changed * Updated `_should_skip_auditing` logic to conditionally include `GET` requests. * Reordered logic to ensure auth endpoints are always audited. ### Fixed * Fixed issue where auth endpoints (`/api/v1/auths/*`) were not logged when accessed via `GET`. --- ### Additional Information * `AUDIT_LOG_GET_REQUESTS=false` (default): GET requests are skipped. * `AUDIT_LOG_GET_REQUESTS=true`: GET requests are included in audit logs. * No breaking changes introduced. --- ### Testing * Verified authenticated API requests using `/api/v1/models` * Confirmed no regression in existing POST/PUT/PATCH/DELETE behavior * Verified logic correctness by ensuring request flow works as expected * Tested both configurations: * `AUDIT_LOG_GET_REQUESTS=false` → GET requests skipped * `AUDIT_LOG_GET_REQUESTS=true` → GET requests processed --- ### Screenshots or Videos * N/A (backend logic change) --- ### Contributor License Agreement * [x] By submitting this pull request, I confirm that I have read and fully agree to the [[Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-21 15:42:23 -05:00

GiteaMirror closed this issue

2026-05-21 15:42:26 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#130921