github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-07-22 11:44:11 -05:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

[PR #20076] [MERGED] fix: MCP OAuth 2.1 token exchange and multi-node propagation #25456

New Issue
Closed
opened 2026-04-20 05:56:40 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-20 05:56:40 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/20076
Author: @Classic298
Created: 12/21/2025
Status: ✅ Merged
Merged: 12/21/2025
Merged by: @tjbck

Base: dev ← Head: mcp

📝 Commits (9)

  • 08ddf0d sequential
  • d11de16 Merge branch 'open-webui:dev' into dev
  • 66352dc zero default
  • c16aff0 fix
  • 7acb389 fix: preserve absolute paths in sqlite+sqlcipher URLs
  • 3e31cdc Merge branch 'open-webui:dev' into dev
  • 0f0aec5 fix: MCP OAuth 2.1 token exchange and multi-node propagation
  • 359f866 Update db.py
  • c5f3e28 Update wrappers.py

📊 Changes

1 file changed (+20 additions, -11 deletions)

View changed files

📝 backend/open_webui/utils/oauth.py (+20 -11)

📄 Description

Pull Request Checklist

Fix two MCP OAuth 2.1 bugs affecting tool server authentication:

  1. Token exchange failing with duplicate credentials (#19823)

    • Removed explicit client_id/client_secret passing in handle_callback()
    • Authlib already has credentials configured during add_client(),
      passing them again caused concatenation (e.g., "ID1,ID1") and 401 errors
    • Added token validation to detect missing access_token and provide
      clear error messages instead of cryptic database constraint errors

  2. OAuth clients not propagating across multi-node setups (#19901)

    • Updated get_client() and get_client_info() to auto-lazy-load
      OAuth clients from the Redis-synced TOOL_SERVER_CONNECTIONS config
    • Clients are now instantiated on-demand on any node that needs them

Fixes #19823, #19901

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/20076 **Author:** [@Classic298](https://github.com/Classic298) **Created:** 12/21/2025 **Status:** ✅ Merged **Merged:** 12/21/2025 **Merged by:** [@tjbck](https://github.com/tjbck) **Base:** `dev` ← **Head:** `mcp` --- ### 📝 Commits (9) - [`08ddf0d`](https://github.com/open-webui/open-webui/commit/08ddf0d606a75e1747fa23845b05fae6e678bdeb) sequential - [`d11de16`](https://github.com/open-webui/open-webui/commit/d11de164d28813ded7fa677b1e036df85deb0fe6) Merge branch 'open-webui:dev' into dev - [`66352dc`](https://github.com/open-webui/open-webui/commit/66352dc5a9656af278dedd49a4b1af11cb7ea2ea) zero default - [`c16aff0`](https://github.com/open-webui/open-webui/commit/c16aff00f33c57c11ace4a7f30aee20de7b64a10) fix - [`7acb389`](https://github.com/open-webui/open-webui/commit/7acb38977863845ebb8df0b8f78d7d0e109b262e) fix: preserve absolute paths in sqlite+sqlcipher URLs - [`3e31cdc`](https://github.com/open-webui/open-webui/commit/3e31cdcef62032858b08452f7c2122647a15dfdc) Merge branch 'open-webui:dev' into dev - [`0f0aec5`](https://github.com/open-webui/open-webui/commit/0f0aec5e79eccee5040647296e4be8e2076205f0) fix: MCP OAuth 2.1 token exchange and multi-node propagation - [`359f866`](https://github.com/open-webui/open-webui/commit/359f86607210b301fe8237acd1d0b6dde98fd0c7) Update db.py - [`c5f3e28`](https://github.com/open-webui/open-webui/commit/c5f3e28e6706cd299a29297ad8de895e2e4695ee) Update wrappers.py ### 📊 Changes **1 file changed** (+20 additions, -11 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/utils/oauth.py` (+20 -11) </details> ### 📄 Description # Pull Request Checklist Fix two MCP OAuth 2.1 bugs affecting tool server authentication: 1. Token exchange failing with duplicate credentials (#19823) - Removed explicit client_id/client_secret passing in handle_callback() - Authlib already has credentials configured during add_client(), passing them again caused concatenation (e.g., "ID1,ID1") and 401 errors - Added token validation to detect missing access_token and provide clear error messages instead of cryptic database constraint errors 2. OAuth clients not propagating across multi-node setups (#19901) - Updated get_client() and get_client_info() to auto-lazy-load OAuth clients from the Redis-synced TOOL_SERVER_CONNECTIONS config - Clients are now instantiated on-demand on any node that needs them Fixes #19823, #19901 ### Contributor License Agreement By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. > [!NOTE] > Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-20 05:56:40 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#25456