[PR #451] [MERGED] Fix bug: Header attributes (Host, Authorization, Origin, Referer) not sanitized. #20342

New Issue

GiteaMirror · 2026-04-20T02:54:34-05:00

GiteaMirror commented

2026-04-20 02:54:34 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/451
Author: @goecho
Created: 1/11/2024
Status: ✅ Merged
Merged: 1/11/2024
Merged by: @tjbck

Base: main ← Head: main

📝 Commits (1)

74f91bc Fix bug: Header attributes (Host, Authorization, Origin, Referer) not sanitized

📊 Changes

1 file changed (+4 additions, -4 deletions)

View changed files

📝 backend/apps/ollama/main.py (+4 -4)

📄 Description

Fix bug: Header attributes (Host, Authorization, Origin, Referer) not sanitized

Resolved an issue where header attributes Host, Authorization, Origin, and Referer were not being sanitized, resulting in two major issues:
1. Ollama requests inadvertently exposed user information, leading to data leakage.
2. When Ollama is deployed on different servers, and the intermediary proxy layer uses the host header to locate downstream services, it fails to find them.

Root Cause:

In FastAPI, when accessing request.headers, all header names are converted to lowercase. This is because FastAPI, and its underlying framework Starlette, adhere to the HTTP/2 standard, which mandates lowercase header field names for performance and consistency.
In HTTP/2, enforcing lowercase header field names reduces complexity in header processing as case sensitivity is no longer a concern. Thus, regardless of the case used in client-sent header fields, the server processes them uniformly in lowercase.
This practice is adopted in FastAPI and other modern HTTP frameworks, even in an HTTP/1.1 context, to maintain consistency with HTTP/2 and improve overall performance. As a result, header field names are always presented in lowercase in FastAPI, even if the original request used capitalization or mixed case.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/451 **Author:** [@goecho](https://github.com/goecho) **Created:** 1/11/2024 **Status:** ✅ Merged **Merged:** 1/11/2024 **Merged by:** [@tjbck](https://github.com/tjbck) **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (1) - [`74f91bc`](https://github.com/open-webui/open-webui/commit/74f91bc74d9d4b346012ee3f05f020a8fb8f3856) Fix bug: Header attributes (Host, Authorization, Origin, Referer) not sanitized ### 📊 Changes **1 file changed** (+4 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `backend/apps/ollama/main.py` (+4 -4) </details> ### 📄 Description Fix bug: Header attributes (Host, Authorization, Origin, Referer) not sanitized - Resolved an issue where header attributes Host, Authorization, Origin, and Referer were not being sanitized, resulting in two major issues: 1. Ollama requests inadvertently exposed user information, leading to data leakage. 2. When Ollama is deployed on different servers, and the intermediary proxy layer uses the host header to locate downstream services, it fails to find them. Root Cause: - In FastAPI, when accessing request.headers, all header names are converted to lowercase. This is because FastAPI, and its underlying framework Starlette, adhere to the HTTP/2 standard, which mandates lowercase header field names for performance and consistency. - In HTTP/2, enforcing lowercase header field names reduces complexity in header processing as case sensitivity is no longer a concern. Thus, regardless of the case used in client-sent header fields, the server processes them uniformly in lowercase. - This practice is adopted in FastAPI and other modern HTTP frameworks, even in an HTTP/1.1 context, to maintain consistency with HTTP/2 and improve overall performance. As a result, header field names are always presented in lowercase in FastAPI, even if the original request used capitalization or mixed case. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-20 02:54:34 -05:00

GiteaMirror closed this issue

2026-04-20 02:54:35 -05:00

GiteaMirror referenced this issue

2026-04-20 06:00:30 -05:00

[PR #20342] [CLOSED] perf: Fix hybrid search performance regression with parallel collection fetching and BM25 bypass #25575

GiteaMirror referenced this issue

2026-04-25 08:46:47 -05:00

[GH-ISSUE #20327] issue: Unable to use any Open WebUI version newer than 0.6.25 due to hybrid search performance #34681

GiteaMirror referenced this issue

2026-04-25 13:29:29 -05:00

[PR #20342] [CLOSED] perf: Fix hybrid search performance regression with parallel collection fetching and BM25 bypass #41205