I'm experiencing an issue where multiple user API tokens suddenly stopped working, reporting that they've expired, even though they were set to not expire (JWT_EXPIRES_IN = -1). I'm unable to reproduce the issue or provide logs, but the problem occurred without any apparent reason.
Regenerating the tokens resolved the issue, but I'd like to understand the root cause to avoid similar problems in the future. Additionally, I'd like to be able to continue working with some tokens without having to regenerate them.
As a temporary workaround, I updated the updated_at field manually. I propose automatically updating this field using the following code:
This change could potentially prevent similar issues in the future.
Request: Could you help me understand what might have caused this issue and consider implementing the proposed change to automatically update the updated_at field?
Originally created by @voregnev on GitHub (Jul 1, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/15440
I'm experiencing an issue where multiple user API tokens suddenly stopped working, reporting that they've expired, even though they were set to not expire (JWT_EXPIRES_IN = -1). I'm unable to reproduce the issue or provide logs, but the problem occurred without any apparent reason.
Regenerating the tokens resolved the issue, but I'd like to understand the root cause to avoid similar problems in the future. Additionally, I'd like to be able to continue working with some tokens without having to regenerate them.
As a temporary workaround, I updated the `updated_at` field manually. I propose automatically updating this field using the following code:
`updated_at = Column(BigInteger, onupdate=lambda: int(time.time()))`
This change could potentially prevent similar issues in the future.
**Request:** Could you help me understand what might have caused this issue and consider implementing the proposed change to automatically update the `updated_at` field?
https://github.com/open-webui/open-webui/blob/de018f091260ae757a61e9e4d8691be6442e3ea6/backend/open_webui/models/users.py#L31
I know - it just misspelling. i do not change and its setup as JWT_EXPIRES_IN = -1 by default
<!-- gh-comment-id:3023211914 -->
@voregnev commented on GitHub (Jul 1, 2025):
I know - it just misspelling. i do not change and its setup as JWT_EXPIRES_IN = -1 by default
If oauth, as I know, this setting was "removed" due to problems with oauth token expiration checking, there were problems when oauth token expired, but since openwebui JWT token was not expired, user (with expired oauth) could enter openwebui without problems, and this was not desirable.
<!-- gh-comment-id:3023441044 -->
@rgaricano commented on GitHub (Jul 1, 2025):
Ok, what it's your auth method ?
If oauth, as I know, this setting was "removed" due to problems with oauth token expiration checking, there were problems when oauth token expired, but since openwebui JWT token was not expired, user (with expired oauth) could enter openwebui without problems, and this was not desirable.
For reference:
https://github.com/open-webui/open-webui/blob/59ba21bdf8eb791a412db869a13ff76c6135b651/backend/open_webui/utils/misc.py#L339-L341
https://github.com/open-webui/open-webui/blob/59ba21bdf8eb791a412db869a13ff76c6135b651/backend/open_webui/utils/oauth.py#L508-L511
https://github.com/open-webui/open-webui/blob/59ba21bdf8eb791a412db869a13ff76c6135b651/backend/open_webui/routers/auths.py#L385
(& L507 & L605)
Maybe a work around is set a 9999999999 JWT_EXPIRES_IN instead of -1 or 0
<!-- gh-comment-id:3023465171 -->
@rgaricano commented on GitHub (Jul 1, 2025):
Maybe a work around is set a 9999999999 JWT_EXPIRES_IN instead of -1 or 0
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @voregnev on GitHub (Jul 1, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/15440
I'm experiencing an issue where multiple user API tokens suddenly stopped working, reporting that they've expired, even though they were set to not expire (JWT_EXPIRES_IN = -1). I'm unable to reproduce the issue or provide logs, but the problem occurred without any apparent reason.
Regenerating the tokens resolved the issue, but I'd like to understand the root cause to avoid similar problems in the future. Additionally, I'd like to be able to continue working with some tokens without having to regenerate them.
As a temporary workaround, I updated the
updated_atfield manually. I propose automatically updating this field using the following code:updated_at = Column(BigInteger, onupdate=lambda: int(time.time()))This change could potentially prevent similar issues in the future.
Request: Could you help me understand what might have caused this issue and consider implementing the proposed change to automatically update the
updated_atfield?https://github.com/open-webui/open-webui/blob/de018f091260ae757a61e9e4d8691be6442e3ea6/backend/open_webui/models/users.py#L31
@rgaricano commented on GitHub (Jul 1, 2025):
the env var is:
JWT_EXPIRES_IN@voregnev commented on GitHub (Jul 1, 2025):
I know - it just misspelling. i do not change and its setup as JWT_EXPIRES_IN = -1 by default
@rgaricano commented on GitHub (Jul 1, 2025):
Ok, what it's your auth method ?
If oauth, as I know, this setting was "removed" due to problems with oauth token expiration checking, there were problems when oauth token expired, but since openwebui JWT token was not expired, user (with expired oauth) could enter openwebui without problems, and this was not desirable.
For reference:
https://github.com/open-webui/open-webui/blob/59ba21bdf8eb791a412db869a13ff76c6135b651/backend/open_webui/utils/misc.py#L339-L341
https://github.com/open-webui/open-webui/blob/59ba21bdf8eb791a412db869a13ff76c6135b651/backend/open_webui/utils/oauth.py#L508-L511
https://github.com/open-webui/open-webui/blob/59ba21bdf8eb791a412db869a13ff76c6135b651/backend/open_webui/routers/auths.py#L385
(& L507 & L605)
@rgaricano commented on GitHub (Jul 1, 2025):
Maybe a work around is set a 9999999999 JWT_EXPIRES_IN instead of -1 or 0