github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-05-06 10:58:17 -05:00
Code Issues 1.3k Packages Projects Releases 126 Wiki Activity

[GH-ISSUE #8252] bug: ENABLE_API_KEY_ENDPOINT_RESTRICTIONS feature does not work #30580

New Issue
Closed
opened 2026-04-25 04:48:52 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-04-25 04:48:52 -05:00
Owner
Copy Link

Originally created by @ndrsfel on GitHub (Jan 1, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/8252

Bug Report

Installation Method

Docker

Environment

  • Open WebUI Version: v0.5.3

  • Operating System: macOS

Confirmation:

  • I have read and followed all the instructions provided in the README.md.
  • I am on the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below.

Expected Behavior:

One can restrict API key access using ENABLE_API_KEY_ENDPOINT_RESTRICTIONS & API_KEY_ALLOWED_ENDPOINTS environment variables.

Actual Behavior:

One get's the following exception/error

2025-01-01T18:12:36.954948518Z   File "/app/backend/open_webui/utils/auth.py", line 102, in get_current_user
2025-01-01T18:12:36.954951718Z     for path in str(request.app.state.config.API_KEY_ALLOWED_PATHS).split(
2025-01-01T18:12:36.954955218Z                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2025-01-01T18:12:36.954958218Z   File "/app/backend/open_webui/config.py", line 262, in __getattr__
2025-01-01T18:12:36.954961618Z     return self._state[key].value
2025-01-01T18:12:36.954965119Z            ~~~~~~~~~~~^^^^^
2025-01-01T18:12:36.954968119Z KeyError: 'API_KEY_ALLOWED_PATHS'

Description

Bug Summary: To fix, please refac this section of the code to use API_KEY_ALLOWED_ENDPOINTS instead of API_KEY_ALLOWED_PATHS as the error states above.

Thank you for this awesome tool, Tim!

Originally created by @ndrsfel on GitHub (Jan 1, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/8252 # Bug Report ## Installation Method Docker ## Environment - **Open WebUI Version:** v0.5.3 - **Operating System:** macOS **Confirmation:** - [x] I have read and followed all the instructions provided in the README.md. - [x] I am on the latest version of both Open WebUI and Ollama. - [ ] I have included the browser console logs. - [ ] I have included the Docker container logs. - [x] I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below. ## Expected Behavior: One can restrict API key access using `ENABLE_API_KEY_ENDPOINT_RESTRICTIONS` & `API_KEY_ALLOWED_ENDPOINTS` environment variables. ## Actual Behavior: One get's the following exception/error ```txt 2025-01-01T18:12:36.954948518Z File "/app/backend/open_webui/utils/auth.py", line 102, in get_current_user 2025-01-01T18:12:36.954951718Z for path in str(request.app.state.config.API_KEY_ALLOWED_PATHS).split( 2025-01-01T18:12:36.954955218Z ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 2025-01-01T18:12:36.954958218Z File "/app/backend/open_webui/config.py", line 262, in __getattr__ 2025-01-01T18:12:36.954961618Z return self._state[key].value 2025-01-01T18:12:36.954965119Z ~~~~~~~~~~~^^^^^ 2025-01-01T18:12:36.954968119Z KeyError: 'API_KEY_ALLOWED_PATHS' ``` ## Description **Bug Summary:** To fix, please refac [this](https://github.com/open-webui/open-webui/blob/00a089b59683a9d48a2c97f739c8a781ba27b61f/backend/open_webui/utils/auth.py#L102C58-L102C79) section of the code to use `API_KEY_ALLOWED_ENDPOINTS` instead of `API_KEY_ALLOWED_PATHS` as the error states above. Thank you for this awesome tool, Tim!
GiteaMirror commented 2026-04-25 04:48:56 -05:00
Author
Owner
Copy Link

@tjbck commented on GitHub (Jan 1, 2025):

Its's a persistent config, and must be configured from the ui.

<!-- gh-comment-id:2567134800 --> @tjbck commented on GitHub (Jan 1, 2025): Its's a persistent config, and must be configured from the ui.
GiteaMirror commented 2026-04-25 04:48:58 -05:00
Author
Owner
Copy Link

@ndrsfel commented on GitHub (Jan 3, 2025):

@tjbck Sorry for not being clear here, a quick search in the codebase shows, that there is no request.app.state.config.API_KEY_ALLOWED_PATHS or API_KEY_ALLOWED_PATHS configurable via Admin UI.

Rather, this is a typo and should be re-named to request.app.state.config.API_KEY_ALLOWED_ENDPOINTS. Then, this is actually the correct value the Admin UI AND the environment variables point to.

<!-- gh-comment-id:2568932512 --> @ndrsfel commented on GitHub (Jan 3, 2025): @tjbck Sorry for not being clear here, a quick search in the codebase shows, that there is no `request.app.state.config.API_KEY_ALLOWED_PATHS` or `API_KEY_ALLOWED_PATHS` configurable via Admin UI. Rather, this is a typo and should be re-named to `request.app.state.config.API_KEY_ALLOWED_ENDPOINTS`. Then, this is actually the correct value the Admin UI AND the environment variables point to.
GiteaMirror commented 2026-04-25 04:49:00 -05:00
Author
Owner
Copy Link

@ndrsfel commented on GitHub (Jan 5, 2025):

fixed with 99c3194. Thank you!

<!-- gh-comment-id:2571574139 --> @ndrsfel commented on GitHub (Jan 5, 2025): fixed with 99c3194. Thank you!
GiteaMirror commented 2026-04-25 04:49:01 -05:00
Author
Owner
Copy Link

@tjbck commented on GitHub (Jan 5, 2025):

@ndrsfel I must've been half awake half asleep reading your post, apologies for the confusion and thanks for the report! 😅

<!-- gh-comment-id:2571575432 --> @tjbck commented on GitHub (Jan 5, 2025): @ndrsfel I must've been half awake half asleep reading your post, apologies for the confusion and thanks for the report! 😅
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#30580
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?