Originally created by @stevenbaert on GitHub (Sep 12, 2024).
Bug Report
Installation Method
Docker
Environment
0.3.21
Operating System: Linux (Synology)
**Browser (if applicable):Edge Chromium
Confirmation:
[ x] I have read and followed all the instructions provided in the README.md.
[x ] I am on the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below.
Expected Behavior:
New sign ups should be rejected
Actual Behavior:
Sign ups are allowed and totally unknown users show up as pending member into my list of users.
Description
Bug Summary:
See actual behavior
Reproduction Details
Steps to Reproduce:
Not relevant, users sign up though they should not be allowed to.
Originally created by @stevenbaert on GitHub (Sep 12, 2024).
# Bug Report
## Installation Method
Docker
## Environment
0.3.21
- **Operating System:** Linux (Synology)
- **Browser (if applicable):Edge Chromium
**Confirmation:**
- [ x] I have read and followed all the instructions provided in the README.md.
- [x ] I am on the latest version of both Open WebUI and Ollama.
- [ ] I have included the browser console logs.
- [ ] I have included the Docker container logs.
- [ ] I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below.
## Expected Behavior:
New sign ups should be rejected
## Actual Behavior:
Sign ups are allowed and totally unknown users show up as *pending* member into my list of users.
## Description
**Bug Summary:**
See actual behavior
## Reproduction Details
**Steps to Reproduce:**
Not relevant, users sign up though they should not be allowed to.
@silentoplayz commented on GitHub (Sep 13, 2024):
Working fine for me on the latest dev.

I’m not sure I fully understand your point. I exclusively use OAuth for sign-ins, as it’s the most secure method, and passwords are vulnerable to brute-force attacks. Through OAuth, any ramdom user can log in via Google and then they still appear in a ‘pending’ state. I’m using the latest version of Open-Webui, so the issue isn’t resolved for me. My goal is to prevent random users from signing up.
@stevenbaert commented on GitHub (Sep 13, 2024):
I’m not sure I fully understand your point. I exclusively use OAuth for sign-ins, as it’s the most secure method, and passwords are vulnerable to brute-force attacks. Through OAuth, any ramdom user can log in via Google and then they still appear in a ‘pending’ state. I’m using the latest version of Open-Webui, so the issue isn’t resolved for me. My goal is to prevent random users from signing up.
Have you set ENABLE_SIGNUP to false as an environment variable for your Open WebUI instance or disabled new sign ups within the GUI?
@silentoplayz commented on GitHub (Sep 13, 2024):
Have you set `ENABLE_SIGNUP` to `false` as an environment variable for your Open WebUI instance or disabled new sign ups within the GUI?
Have now done it in gui and in variable container but no change. Any user can still login then it shows this user status pending.
@stevenbaert commented on GitHub (Sep 13, 2024):
Have now done it in gui and in variable container but no change. Any user can still login then it shows this user status pending.
If you have the OAUTH_MERGE_ACCOUNTS_BY_EMAIL environment variable set to true, this bypasses the env var/toggle in the UI to disable new sign ups, which is intended behavior.
@silentoplayz commented on GitHub (Sep 13, 2024):
If you have the [OAUTH_MERGE_ACCOUNTS_BY_EMAIL](https://docs.openwebui.com/getting-started/env-configuration#oauth_merge_accounts_by_email) environment variable set to `true`, this bypasses the env var/toggle in the UI to disable new sign ups, which is intended behavior.
Have now done it in gui and in variable container but no change. Any user can still login then it shows this user status pending.
Also merge is not enabled.
@stevenbaert commented on GitHub (Sep 13, 2024):
Have now done it in gui and in variable container but no change. Any user can still login then it shows this user status pending.
Also merge is not enabled.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @stevenbaert on GitHub (Sep 12, 2024).
Bug Report
Installation Method
Docker
Environment
0.3.21
Confirmation:
Expected Behavior:
New sign ups should be rejected
Actual Behavior:
Sign ups are allowed and totally unknown users show up as pending member into my list of users.
Description
Bug Summary:
See actual behavior
Reproduction Details
Steps to Reproduce:
Not relevant, users sign up though they should not be allowed to.
@silentoplayz commented on GitHub (Sep 13, 2024):
Working fine for me on the latest dev.

@stevenbaert commented on GitHub (Sep 13, 2024):
I’m not sure I fully understand your point. I exclusively use OAuth for sign-ins, as it’s the most secure method, and passwords are vulnerable to brute-force attacks. Through OAuth, any ramdom user can log in via Google and then they still appear in a ‘pending’ state. I’m using the latest version of Open-Webui, so the issue isn’t resolved for me. My goal is to prevent random users from signing up.
@silentoplayz commented on GitHub (Sep 13, 2024):
Have you set
ENABLE_SIGNUPtofalseas an environment variable for your Open WebUI instance or disabled new sign ups within the GUI?@stevenbaert commented on GitHub (Sep 13, 2024):
Only within the GUI.
@stevenbaert commented on GitHub (Sep 13, 2024):
Have now done it in gui and in variable container but no change. Any user can still login then it shows this user status pending.
@silentoplayz commented on GitHub (Sep 13, 2024):
If you have the OAUTH_MERGE_ACCOUNTS_BY_EMAIL environment variable set to
true, this bypasses the env var/toggle in the UI to disable new sign ups, which is intended behavior.@stevenbaert commented on GitHub (Sep 13, 2024):
Have now done it in gui and in variable container but no change. Any user can still login then it shows this user status pending.
Also merge is not enabled.
@tjbck commented on GitHub (Sep 14, 2024):
Should be fixed with the latest dev, test wanted here!