Terminal server verification was performed directly from the browser, exposing API keys in network traffic and browser dev tools.
Solution
Add backend proxy endpoint /api/v1/configs/terminal_servers/verify that performs the verification server-side
Modify frontend detectTerminalServerType to use the backend proxy instead of direct browser fetch
Security Impact
API keys are no longer visible in browser network tab
Reduces attack surface for API key theft via browser extensions or network sniffing
Testing
Go to Admin Panel > Connections > Terminal Servers
Add a terminal server with an API key
Click "Verify Connection"
Check browser network tab - no direct requests to terminal server URL
Verification should still work correctly
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/23059
**Author:** [@yang1002378395-cmyk](https://github.com/yang1002378395-cmyk)
**Created:** 3/26/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `fix-terminal-server-api-exposure`
---
### 📝 Commits (3)
- [`efb0f9a`](https://github.com/open-webui/open-webui/commit/efb0f9a6f29ce9afa1ee50b7e6bb3d628e636fd2) fix: add pagination to chat list endpoints to prevent OOM
- [`db10981`](https://github.com/open-webui/open-webui/commit/db10981fbcbdbe204008d1b4e7378d4a839e0c8d) fix: clear stale Redis tasks on startup
- [`949cf59`](https://github.com/open-webui/open-webui/commit/949cf595623dafc17c08b50120f0ce0ef7646004) fix: use backend proxy for terminal server verification
### 📊 Changes
**6 files changed** (+134 additions, -34 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/main.py` (+3 -0)
📝 `backend/open_webui/models/chats.py` (+19 -9)
📝 `backend/open_webui/routers/chats.py` (+15 -6)
📝 `backend/open_webui/routers/configs.py` (+42 -0)
📝 `backend/open_webui/tasks.py` (+31 -0)
📝 `src/lib/apis/configs/index.ts` (+24 -19)
</details>
### 📄 Description
## Issue
Fixes #23048
## Problem
Terminal server verification was performed directly from the browser, exposing API keys in network traffic and browser dev tools.
## Solution
- Add backend proxy endpoint `/api/v1/configs/terminal_servers/verify` that performs the verification server-side
- Modify frontend `detectTerminalServerType` to use the backend proxy instead of direct browser fetch
## Security Impact
- API keys are no longer visible in browser network tab
- Reduces attack surface for API key theft via browser extensions or network sniffing
## Testing
1. Go to Admin Panel > Connections > Terminal Servers
2. Add a terminal server with an API key
3. Click "Verify Connection"
4. Check browser network tab - no direct requests to terminal server URL
5. Verification should still work correctly
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/23059
Author: @yang1002378395-cmyk
Created: 3/26/2026
Status: ❌ Closed
Base:
main← Head:fix-terminal-server-api-exposure📝 Commits (3)
efb0f9afix: add pagination to chat list endpoints to prevent OOMdb10981fix: clear stale Redis tasks on startup949cf59fix: use backend proxy for terminal server verification📊 Changes
6 files changed (+134 additions, -34 deletions)
View changed files
📝
backend/open_webui/main.py(+3 -0)📝
backend/open_webui/models/chats.py(+19 -9)📝
backend/open_webui/routers/chats.py(+15 -6)📝
backend/open_webui/routers/configs.py(+42 -0)📝
backend/open_webui/tasks.py(+31 -0)📝
src/lib/apis/configs/index.ts(+24 -19)📄 Description
Issue
Fixes #23048
Problem
Terminal server verification was performed directly from the browser, exposing API keys in network traffic and browser dev tools.
Solution
/api/v1/configs/terminal_servers/verifythat performs the verification server-sidedetectTerminalServerTypeto use the backend proxy instead of direct browser fetchSecurity Impact
Testing
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.