4b2caac Fix: remove undefined cookie_expires from OAuth session cookie
📊 Changes
1 file changed (+1 additions, -1 deletions)
View changed files
📝backend/open_webui/utils/oauth.py (+1 -1)
📄 Description
Bug
handle_callback in oauth.py (line 1686) references cookie_expires when setting the oauth_session_id cookie, but this variable is never defined. This causes a NameError that silently prevents OAuth sessions from being stored server-side.
Error: Failed to store OAuth session server-side: name 'cookie_expires' is not defined
This breaks:
system_oauth auth type for OpenAI connections (no session to read the token from)
Any feature that depends on the OAuth session being stored
Fix
Remove cookie_expires from the dict spread. cookie_max_age (which IS defined at line 1627) is sufficient and is the standard way to set cookie expiry. All other set_cookie calls in the same function correctly use only cookie_max_age.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/23513
**Author:** [@rapartlu](https://github.com/rapartlu)
**Created:** 4/8/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `fix/oauth-session-cookie-expires`
---
### 📝 Commits (1)
- [`4b2caac`](https://github.com/open-webui/open-webui/commit/4b2caac60ead1fdb404d423670558d4951992898) Fix: remove undefined cookie_expires from OAuth session cookie
### 📊 Changes
**1 file changed** (+1 additions, -1 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/utils/oauth.py` (+1 -1)
</details>
### 📄 Description
## Bug
handle_callback in oauth.py (line 1686) references cookie_expires when setting the oauth_session_id cookie, but this variable is never defined. This causes a NameError that silently prevents OAuth sessions from being stored server-side.
Error: Failed to store OAuth session server-side: name 'cookie_expires' is not defined
This breaks:
- system_oauth auth type for OpenAI connections (no session to read the token from)
- Any feature that depends on the OAuth session being stored
## Fix
Remove cookie_expires from the dict spread. cookie_max_age (which IS defined at line 1627) is sufficient and is the standard way to set cookie expiry. All other set_cookie calls in the same function correctly use only cookie_max_age.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/23513
Author: @rapartlu
Created: 4/8/2026
Status: ❌ Closed
Base:
main← Head:fix/oauth-session-cookie-expires📝 Commits (1)
4b2caacFix: remove undefined cookie_expires from OAuth session cookie📊 Changes
1 file changed (+1 additions, -1 deletions)
View changed files
📝
backend/open_webui/utils/oauth.py(+1 -1)📄 Description
Bug
handle_callback in oauth.py (line 1686) references cookie_expires when setting the oauth_session_id cookie, but this variable is never defined. This causes a NameError that silently prevents OAuth sessions from being stored server-side.
Error: Failed to store OAuth session server-side: name 'cookie_expires' is not defined
This breaks:
Fix
Remove cookie_expires from the dict spread. cookie_max_age (which IS defined at line 1627) is sufficient and is the standard way to set cookie expiry. All other set_cookie calls in the same function correctly use only cookie_max_age.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.