[PR #22359] [MERGED] fix: add support for scope in OAuth refresh token request #26630

New Issue

GiteaMirror · 2026-04-20T06:36:46-05:00

GiteaMirror commented

2026-04-20 06:36:46 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/22359
Author: @pedro-inf-custodio
Created: 3/7/2026
Status: ✅ Merged
Merged: 3/8/2026
Merged by: @tjbck

Base: dev ← Head: fix/add-scope-refresh-token-oauth

📝 Commits (6)

416597a fix: add support for scope in OAuth refresh token request
6b93e33 add oauth refresh token include scope
b9cca4b Fix variable import
a461157 Fix env variables import
efd7ac9 Added debug logs WIP
781333e Remove debug logs

📊 Changes

2 files changed (+28 additions, -0 deletions)

View changed files

📝 backend/open_webui/config.py (+6 -0)
📝 backend/open_webui/utils/oauth.py (+22 -0)

📄 Description

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

Description

This PR fixes an issue where the refresh token request for Microsoft OAuth was failing with error AADSTS90009. Previously, the refresh payload only included the grant_type, refresh_token, client_id, and optionally client_secret.

Azure AD requires the scope (or resource) to be explicitly provided when refreshing a token. Without it, Azure interprets the request as “the application is requesting a token for itself,” which triggers the 400 error:

AADSTS90009: Application '[APPLICATION_ID]' is requesting a token for itself.

Changes

Added support for including a custom scope in the refresh token request.
The scope is read from the environment variable MICROSOFT_OAUTH_SCOPE.
Example format for the scope:

openid email profile offline_access api://<Application ID URI>/<custom_scope>

Updated _perform_token_refresh to include this scope when refreshing tokens.

Root Cause

Azure AD v2.0 requires explicit scopes in refresh token requests to determine which resource the new access token should target.
Omitting scope caused Azure to treat the request as self-targeted, resulting in AADSTS90009.
Including the custom scope resolves this and allows token refreshes to succeed.

Logs Before Fix

Token refresh failed for provider microsoft: 400 - {"error":"invalid_request","error_description":"AADSTS90009: Application '[APPLICATION_ID]' is requesting a token for itself."}

Logs After Fix

Refresh token requests now succeed, and new access tokens are issued without errors.

Environment Variables

MICROSOFT_OAUTH_SCOPE (required) – the custom scope for token requests.

Optional Configuration (Potential Follow-up)

As a potential follow-up improvement, it may also be possible to control this behavior via an environment variable, if maintainers consider this a suitable approach:

OAUTH_REFRESH_TOKEN_INCLUDE_SCOPE=false # default

This would allow enabling or disabling the inclusion of the scope parameter in refresh token requests.

This approach remains compliant with RFC 6749 Section 6, where the scope parameter is optional during refresh token requests and typically omitted unless required by the OAuth provider.

This option would only need to be enabled for OAuth providers that require scope to be included in refresh token requests (such as some Azure AD configurations).

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/22359 **Author:** [@pedro-inf-custodio](https://github.com/pedro-inf-custodio) **Created:** 3/7/2026 **Status:** ✅ Merged **Merged:** 3/8/2026 **Merged by:** [@tjbck](https://github.com/tjbck) **Base:** `dev` ← **Head:** `fix/add-scope-refresh-token-oauth` --- ### 📝 Commits (6) - [`416597a`](https://github.com/open-webui/open-webui/commit/416597a9e4bf7f74a1a80096aa8a0f49ae79dbae) fix: add support for scope in OAuth refresh token request - [`6b93e33`](https://github.com/open-webui/open-webui/commit/6b93e33de7480bdff4672426578157e763d61aff) add oauth refresh token include scope - [`b9cca4b`](https://github.com/open-webui/open-webui/commit/b9cca4bac9bd1f2653b0d8cb60eddfa3575c762a) Fix variable import - [`a461157`](https://github.com/open-webui/open-webui/commit/a4611570d9b065e187038cb0faf43e97cef04c7d) Fix env variables import - [`efd7ac9`](https://github.com/open-webui/open-webui/commit/efd7ac970686f9334ac909a35601db52113ef60d) Added debug logs WIP - [`781333e`](https://github.com/open-webui/open-webui/commit/781333e3668c68bbcaf7e1dfaa5c6b9b0e29269c) Remove debug logs ### 📊 Changes **2 files changed** (+28 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/config.py` (+6 -0) 📝 `backend/open_webui/utils/oauth.py` (+22 -0) </details> ### 📄 Description ### Contributor License Agreement By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. > **Note** > > Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in. --- ## Description This PR fixes an issue where the refresh token request for Microsoft OAuth was failing with error `AADSTS90009`. Previously, the refresh payload only included the `grant_type`, `refresh_token`, `client_id`, and optionally `client_secret`. Azure AD requires the **scope (or resource)** to be explicitly provided when refreshing a token. Without it, Azure interprets the request as “the application is requesting a token for itself,” which triggers the 400 error: ``` AADSTS90009: Application '[APPLICATION_ID]' is requesting a token for itself. ``` ### Changes - Added support for including a **custom scope** in the refresh token request. - The scope is read from the environment variable `MICROSOFT_OAUTH_SCOPE`. - Example format for the scope: ``` openid email profile offline_access api://<Application ID URI>/<custom_scope> ``` - Updated `_perform_token_refresh` to include this scope when refreshing tokens. ### Root Cause - Azure AD v2.0 requires **explicit scopes** in refresh token requests to determine which resource the new access token should target. - Omitting `scope` caused Azure to treat the request as self-targeted, resulting in `AADSTS90009`. - Including the custom scope resolves this and allows token refreshes to succeed. ### Logs Before Fix ``` Token refresh failed for provider microsoft: 400 - {"error":"invalid_request","error_description":"AADSTS90009: Application '[APPLICATION_ID]' is requesting a token for itself."} ``` ### Logs After Fix - Refresh token requests now succeed, and new access tokens are issued without errors. ### Environment Variables - `MICROSOFT_OAUTH_SCOPE` (required) – the custom scope for token requests. ### Optional Configuration (Potential Follow-up) As a potential follow-up improvement, it may also be possible to control this behavior via an environment variable, if maintainers consider this a suitable approach: `OAUTH_REFRESH_TOKEN_INCLUDE_SCOPE=false # default` This would allow enabling or disabling the inclusion of the `scope` parameter in refresh token requests. This approach remains compliant with **RFC 6749 Section 6**, where the `scope` parameter is optional during refresh token requests and typically omitted unless required by the OAuth provider. > This option would only need to be enabled for OAuth providers that require `scope` to be included in refresh token requests (such as some Azure AD configurations). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-20 06:36:46 -05:00

GiteaMirror closed this issue

2026-04-20 06:36:48 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#26630