[GH-ISSUE #16490] issue: USER_PERMISSIONS_CHAT_TEMPORARY_ENFORCED=True doesn't work for any user role #17927

Closed
opened 2026-04-19 23:49:17 -05:00 by GiteaMirror · 6 comments
Owner

Originally created by @mpangrazzi on GitHub (Aug 11, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/16490

Check Existing Issues

  • I have searched the existing issues and discussions.
  • I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

latest

Ollama Version (if applicable)

latest

Operating System

MacOS Sequoia / Ubuntu Linux 24.04

Browser (if applicable)

Brave / Chrome

Confirmation

  • I have read and followed all instructions in README.md.
  • I am using the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have provided every relevant configuration, setting, and environment variable used in my setup.
  • I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
  • I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
  • Start with the initial platform/version/OS and dependencies used,
  • Specify exact install/launch/configure commands,
  • List URLs visited, user input (incl. example values/emails/passwords if needed),
  • Describe all options and toggles enabled or changed,
  • Include any files or environmental changes,
  • Identify the expected and actual result at each stage,
  • Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

USER_PERMISSIONS_CHAT_TEMPORARY_ENFORCED works as expected

Actual Behavior

Any message ends up to a 404 error.

Steps to Reproduce

  1. Launch Open WebUI with:
  • USER_PERMISSIONS_CHAT_TEMPORARY_ENFORCED=True
  • WEBUI_AUTH=True
  • BYPASS_MODEL_ACCESS_CONTROL=True
  • ENABLE_SIGNUP=True
  1. Create an admin user

  2. Create an user

  3. With the user, try to initiate a chat (temporary chat banner will show up)

  4. You get the error above

It seems that frontend is not sending correct JSON body when USER_PERMISSIONS_CHAT_TEMPORARY_ENFORCED is enabled (everything works when it's set to False).

Logs & Screenshots

Image

Additional Information

No response

Originally created by @mpangrazzi on GitHub (Aug 11, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/16490 ### Check Existing Issues - [x] I have searched the existing issues and discussions. - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version latest ### Ollama Version (if applicable) latest ### Operating System MacOS Sequoia / Ubuntu Linux 24.04 ### Browser (if applicable) Brave / Chrome ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior USER_PERMISSIONS_CHAT_TEMPORARY_ENFORCED works as expected ### Actual Behavior Any message ends up to a 404 error. ### Steps to Reproduce 1. Launch Open WebUI with: - `USER_PERMISSIONS_CHAT_TEMPORARY_ENFORCED=True` - `WEBUI_AUTH=True` - `BYPASS_MODEL_ACCESS_CONTROL=True` - `ENABLE_SIGNUP=True` 2. Create an `admin` user 3. Create an `user` 4. With the `user`, try to initiate a chat (temporary chat banner will show up) 5. You get the error above It seems that frontend is not sending correct JSON body when `USER_PERMISSIONS_CHAT_TEMPORARY_ENFORCED` is enabled (everything works when it's set to `False`). ### Logs & Screenshots <img width="1723" height="373" alt="Image" src="https://github.com/user-attachments/assets/ee37c8e7-4f5c-49ed-b3d9-489cb812b23e" /> ### Additional Information _No response_
GiteaMirror added the bug label 2026-04-19 23:49:17 -05:00
Author
Owner

@Classic298 commented on GitHub (Aug 11, 2025):

Did you check the user specific permissions in the admin panel that overwrite environment variables?

<!-- gh-comment-id:3175827752 --> @Classic298 commented on GitHub (Aug 11, 2025): Did you check the user specific permissions in the admin panel that overwrite environment variables?
Author
Owner

@mpangrazzi commented on GitHub (Aug 11, 2025):

@Classic298 Yes, they seems to be correct.

Also, it seems that the issue is caused by this check.

When temporary_enforced is enabled, the frontend send chat_id: "local" and this check on DB is failing because local should not be a real database record.

Updating the line above to:

if metadata.get("chat_id") and metadata["chat_id"] != "local" and (user and user.role != "admin"):
# ...

Fixes the issue. Does it make sense to you?

<!-- gh-comment-id:3175987264 --> @mpangrazzi commented on GitHub (Aug 11, 2025): @Classic298 Yes, they seems to be correct. Also, it seems that the issue is caused by [this check](https://github.com/open-webui/open-webui/blob/438e5d966f0f64f9ea3feab22724a5bd96a4127b/backend/open_webui/main.py#L1446). When `temporary_enforced` is enabled, the frontend send `chat_id: "local"` and this check on DB is failing because `local` should not be a real database record. Updating the line above to: ```python if metadata.get("chat_id") and metadata["chat_id"] != "local" and (user and user.role != "admin"): # ... ``` Fixes the issue. Does it make sense to you?
Author
Owner

@alexchesn commented on GitHub (Aug 12, 2025):

This looks related - https://github.com/open-webui/open-webui/discussions/16475

<!-- gh-comment-id:3177544428 --> @alexchesn commented on GitHub (Aug 12, 2025): This looks related - https://github.com/open-webui/open-webui/discussions/16475
Author
Owner

@tjbck commented on GitHub (Aug 13, 2025):

@SaraDark @mpangrazzi could you confirm the issue has been addressed in dev?

<!-- gh-comment-id:3184129249 --> @tjbck commented on GitHub (Aug 13, 2025): @SaraDark @mpangrazzi could you confirm the issue has been addressed in dev?
Author
Owner

@SaraDark commented on GitHub (Aug 13, 2025):

not really, I just use the official Docker image, I don't know how I would check it

<!-- gh-comment-id:3184161467 --> @SaraDark commented on GitHub (Aug 13, 2025): not really, I just use the official Docker image, I don't know how I would check it
Author
Owner

@mpangrazzi commented on GitHub (Aug 13, 2025):

@tjbck Yes, it was fixed with this (not https://github.com/open-webui/open-webui/commit/e7d9755d97b8a9d49289ba5a28d1e958803dd687). Thanks!

<!-- gh-comment-id:3184391814 --> @mpangrazzi commented on GitHub (Aug 13, 2025): @tjbck Yes, it was fixed with [this](https://github.com/mpangrazzi/open-webui/commit/ff55ca4d756b3d9a0024bf9fcc21df735560849b) (not https://github.com/open-webui/open-webui/commit/e7d9755d97b8a9d49289ba5a28d1e958803dd687). Thanks!
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#17927