[PR #22607] [CLOSED] fix: use FORWARDED_ALLOW_IPS env var in start.sh instead of hardcoded wildcard #26777

New Issue

GiteaMirror · 2026-04-20T06:42:21-05:00

GiteaMirror commented

2026-04-20 06:42:21 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/22607
Author: @xr843
Created: 3/12/2026
Status: ❌ Closed

Base: main ← Head: fix/forwarded-allow-ips-env

📝 Commits (1)

613a754 fix: use FORWARDED_ALLOW_IPS env var instead of hardcoded wildcard in start.sh

📊 Changes

1 file changed (+3 additions, -2 deletions)

View changed files

📝 backend/start.sh (+3 -2)

📄 Description

Summary

start.sh hardcodes --forwarded-allow-ips '*' in both the HuggingFace Space path (line 53) and the main uvicorn startup (line 86), ignoring the FORWARDED_ALLOW_IPS environment variable documented in .env.example
This change reads FORWARDED_ALLOW_IPS from the environment with '*' as the default fallback, preserving full backward compatibility while allowing users to restrict forwarded IPs as intended

Fixes #22539

Test plan

Default behavior unchanged (* when env var not set)
Set FORWARDED_ALLOW_IPS=127.0.0.1 and verify uvicorn uses the custom value

🤖 Generated with Claude Code

contributor license agreement

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/22607 **Author:** [@xr843](https://github.com/xr843) **Created:** 3/12/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/forwarded-allow-ips-env` --- ### 📝 Commits (1) - [`613a754`](https://github.com/open-webui/open-webui/commit/613a754c38b6fb93cd55203c4816c729b148d922) fix: use FORWARDED_ALLOW_IPS env var instead of hardcoded wildcard in start.sh ### 📊 Changes **1 file changed** (+3 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `backend/start.sh` (+3 -2) </details> ### 📄 Description ## Summary - `start.sh` hardcodes `--forwarded-allow-ips '*'` in both the HuggingFace Space path (line 53) and the main uvicorn startup (line 86), ignoring the `FORWARDED_ALLOW_IPS` environment variable documented in `.env.example` - This change reads `FORWARDED_ALLOW_IPS` from the environment with `'*'` as the default fallback, preserving full backward compatibility while allowing users to restrict forwarded IPs as intended Fixes #22539 ## Test plan - [x] Default behavior unchanged (`*` when env var not set) - [ ] Set `FORWARDED_ALLOW_IPS=127.0.0.1` and verify uvicorn uses the custom value 🤖 Generated with [Claude Code](https://claude.com/claude-code) contributor license agreement --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-20 06:42:21 -05:00

GiteaMirror closed this issue

2026-04-20 06:42:22 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#26777