github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-05-06 10:58:17 -05:00
Code Issues 1.3k Packages Projects Releases 126 Wiki Activity

[GH-ISSUE #12516] issue: [CONFIG ISSUE, UNRELATED TO OWUI] Web UI accessed via HTTPS returns OAuth redirect URL as HTTP, thus logging a user into an HTTP connection #32162

New Issue
Closed
opened 2026-04-25 06:03:08 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-25 06:03:08 -05:00
Owner
Copy Link

Originally created by @StNiosem on GitHub (Apr 6, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/12516

Check Existing Issues

  • I have searched the existing issues and discussions.
  • I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

v0.6.1

Ollama Version (if applicable)

N/A (only using a LiteLLM endpoint)

Operating System

Ubuntu Server 24.04.2 LTS

Browser (if applicable)

Firefox 137.0 (aarch64) MacOS arm64

Confirmation

  • I have read and followed all instructions in README.md.
  • I am using the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have listed steps to reproduce the bug in detail.

Expected Behavior

  • I press my "Log In With OAuth" button (Internal Login form is disabled)
  • Open-WebUI contacts my OAuth (Authentik) provider with a URL that begins with https://openwebui.DOMAIN
  • My OAuth provider handles the request (<---- That works)
  • Open-WebUI is opened back with a https:// URL

Actual Behavior

  • I press my "Log In With OAuth" button
  • Open-WebUI contacts my OAuth (Authentik) provider with a URL that begins with http://openwebui.DOMAIN
  • My OAuth provider handles the request (<---- That didn't work at first since the Redirect URL didn't match with the https:// scheme)
  • Open-WebUI is opened back with a http:// URL
  • If I then go back to https://openwebui.DOMAIN, I am not logged into the httpS version, but still logged into the http URL.

Steps to Reproduce

  • Set up Open-WebUI with these environment variables (taken from my compose file) :
      WEBUI_URL: "openwebui.DOMAIN"
      DEFAULT_MODELS: 'llama3-70b'
      OAUTH_CLIENT_ID: 'client-id-was-redacted'
      OAUTH_CLIENT_SECRET: 'client-secret-was-redacted'
      OAUTH_PROVIDER_NAME: 'authentik'
      OPENID_PROVIDER_URL: 'https://auth.DOMAIN/application/o/open-webui/.well-known/openid-configuration' #<--- Provider is authentik
      ENABLE_LOGIN_FORM: 'false'
      ENABLE_OAUTH_SIGNUP: 'true'
      USER_AGENT: "Mozilla/5.0 (X11; Linux x86_64) Gecko/20100101 OpenWebUI/1.0" #<--- Tested without, does the same behavior
  • Set up Authentik, with an Application with a slugset to open-webui, and an OAuth 2.0 Provider with client id and secret matching those in the ENV vars
  • Set up a Nginx Proxy Manager instance, and point open-webui to openwebui.YOUR_DOMAIN, and Authentik to auth.YOUR_DOMAIN. Then, set up Let's Encrypt certificates for your domain This is maybe the step that causes problems, as the public URL is https but the internal url is http?? I don't know
  • Try to log in with authentik
  • see the problem for yourself

Logs & Screenshots


2025-04-06 18:11:58.407 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/config HTTP/1.1" 200 - {}
2025-04-06 18:12:01.437 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /oauth/oidc/login HTTP/1.1" 302 - {}
2025-04-06 18:12:09.258 | INFO     | httpx._client:_send_single_request:1740 - HTTP Request: POST https://auth.DOMAIN/application/o/token/ "HTTP/1.1 200 OK" - {}

#----- OAUTH LOGIN ATTEMPT HERE

2025-04-06 18:12:09.509 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /oauth/oidc/callback?code=bad2dbc368da46f1b4f0f65c8a8cca93&state=Uh5NKDuyARUAgPXFcwZKKd4S3tybnr HTTP/1.1" 307 - {}
2025-04-06 18:12:09.776 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/config HTTP/1.1" 200 - {}
2025-04-06 18:12:09.932 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/auths/ HTTP/1.1" 200 - {}
2025-04-06 18:12:10.103 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/config HTTP/1.1" 200 - {}
2025-04-06 18:12:10.163 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/auths/ HTTP/1.1" 200 - {}
2025-04-06 18:12:10.334 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/config HTTP/1.1" 200 - {}
2025-04-06 18:12:10.361 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/changelog HTTP/1.1" 200 - {}
2025-04-06 18:12:10.369 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/users/user/settings HTTP/1.1" 200 - {}

#----- OAUTH LOGIN ENDS HERE, redirected to http site

2025-04-06 18:12:10.422 | INFO     | open_webui.routers.openai:get_all_models:389 - get_all_models() - {}
2025-04-06 18:12:10.439 | INFO     | open_webui.routers.ollama:get_all_models:300 - get_all_models() - {}
2025-04-06 18:12:10.450 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/models HTTP/1.1" 200 - {}
2025-04-06 18:12:10.524 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/configs/banners HTTP/1.1" 200 - {}
2025-04-06 18:12:10.593 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/tools/ HTTP/1.1" 200 - {}
2025-04-06 18:12:10.679 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /ollama/api/version HTTP/1.1" 500 - {}
2025-04-06 18:12:10.715 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/channels/ HTTP/1.1" 200 - {}
2025-04-06 18:12:10.725 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/users/user/settings HTTP/1.1" 200 - {}
2025-04-06 18:12:10.784 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/chats/all/tags HTTP/1.1" 200 - {}
2025-04-06 18:12:10.856 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/chats/pinned HTTP/1.1" 200 - {}
2025-04-06 18:12:10.926 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/version/updates HTTP/1.1" 200 - {}
2025-04-06 18:12:10.945 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/folders/ HTTP/1.1" 200 - {}
2025-04-06 18:12:10.960 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/chats/?page=1 HTTP/1.1" 200 - {}
2025-04-06 18:12:11.286 | INFO     | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/chats/?page=2 HTTP/1.1" 200 - {}

Additional Information

  • I am running open-webui behind a reverse proxy, Nginx Proxy Manager
  • I am using Authentik as an OAuth provider
  • I am running open-webui in a Portainer stack, with open-webui, pipelines, litellm, postgres as a db for litellm, and litellm-exporter to get prometheus metrics
  • This O-WUI instance is very experiments, as is the case for all services I run on my old-ass server (a '09 laptop'
  • Each time you see DOMAIN, i have censored my actual domain name. This domain name is proxied through cloudflare and uses cloudflare nameservers
Originally created by @StNiosem on GitHub (Apr 6, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/12516 ### Check Existing Issues - [x] I have searched the existing issues and discussions. - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version v0.6.1 ### Ollama Version (if applicable) N/A (only using a LiteLLM endpoint) ### Operating System Ubuntu Server 24.04.2 LTS ### Browser (if applicable) Firefox 137.0 (aarch64) MacOS arm64 ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have listed steps to reproduce the bug in detail. ### Expected Behavior - I press my "Log In With OAuth" button (Internal Login form is disabled) - Open-WebUI contacts my OAuth (Authentik) provider with a URL that begins with `https://openwebui.DOMAIN` - My OAuth provider handles the request (<---- That works) - Open-WebUI is opened back with a `https://` URL ### Actual Behavior - I press my "Log In With OAuth" button - Open-WebUI contacts my OAuth (Authentik) provider with a URL that begins with `http://openwebui.DOMAIN` - My OAuth provider handles the request (<---- That didn't work at first since the Redirect URL didn't match with the `https://` scheme) - Open-WebUI is opened back with a `http://` URL - If I then go back to `https://openwebui.DOMAIN`, I am not logged into the httpS version, but still logged into the http URL. ### Steps to Reproduce - Set up Open-WebUI with these environment variables (taken from my compose file) : ``` WEBUI_URL: "openwebui.DOMAIN" DEFAULT_MODELS: 'llama3-70b' OAUTH_CLIENT_ID: 'client-id-was-redacted' OAUTH_CLIENT_SECRET: 'client-secret-was-redacted' OAUTH_PROVIDER_NAME: 'authentik' OPENID_PROVIDER_URL: 'https://auth.DOMAIN/application/o/open-webui/.well-known/openid-configuration' #<--- Provider is authentik ENABLE_LOGIN_FORM: 'false' ENABLE_OAUTH_SIGNUP: 'true' USER_AGENT: "Mozilla/5.0 (X11; Linux x86_64) Gecko/20100101 OpenWebUI/1.0" #<--- Tested without, does the same behavior ``` - Set up Authentik, with an Application with a `slug`set to open-webui, and an OAuth 2.0 Provider with client id and secret matching those in the ENV vars - Set up a [Nginx Proxy Manager](https://nginxproxymanager.com/) instance, and point open-webui to openwebui.YOUR_DOMAIN, and Authentik to auth.YOUR_DOMAIN. Then, set up Let's Encrypt certificates for your domain _**This is maybe the step that causes problems, as the public URL is `https` but the internal url is `http`?? I don't know**_ - Try to log in with authentik - see the problem for yourself ### Logs & Screenshots ``` 2025-04-06 18:11:58.407 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/config HTTP/1.1" 200 - {} 2025-04-06 18:12:01.437 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /oauth/oidc/login HTTP/1.1" 302 - {} 2025-04-06 18:12:09.258 | INFO | httpx._client:_send_single_request:1740 - HTTP Request: POST https://auth.DOMAIN/application/o/token/ "HTTP/1.1 200 OK" - {} #----- OAUTH LOGIN ATTEMPT HERE 2025-04-06 18:12:09.509 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /oauth/oidc/callback?code=bad2dbc368da46f1b4f0f65c8a8cca93&state=Uh5NKDuyARUAgPXFcwZKKd4S3tybnr HTTP/1.1" 307 - {} 2025-04-06 18:12:09.776 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/config HTTP/1.1" 200 - {} 2025-04-06 18:12:09.932 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/auths/ HTTP/1.1" 200 - {} 2025-04-06 18:12:10.103 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/config HTTP/1.1" 200 - {} 2025-04-06 18:12:10.163 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/auths/ HTTP/1.1" 200 - {} 2025-04-06 18:12:10.334 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/config HTTP/1.1" 200 - {} 2025-04-06 18:12:10.361 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/changelog HTTP/1.1" 200 - {} 2025-04-06 18:12:10.369 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/users/user/settings HTTP/1.1" 200 - {} #----- OAUTH LOGIN ENDS HERE, redirected to http site 2025-04-06 18:12:10.422 | INFO | open_webui.routers.openai:get_all_models:389 - get_all_models() - {} 2025-04-06 18:12:10.439 | INFO | open_webui.routers.ollama:get_all_models:300 - get_all_models() - {} 2025-04-06 18:12:10.450 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/models HTTP/1.1" 200 - {} 2025-04-06 18:12:10.524 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/configs/banners HTTP/1.1" 200 - {} 2025-04-06 18:12:10.593 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/tools/ HTTP/1.1" 200 - {} 2025-04-06 18:12:10.679 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /ollama/api/version HTTP/1.1" 500 - {} 2025-04-06 18:12:10.715 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/channels/ HTTP/1.1" 200 - {} 2025-04-06 18:12:10.725 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/users/user/settings HTTP/1.1" 200 - {} 2025-04-06 18:12:10.784 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/chats/all/tags HTTP/1.1" 200 - {} 2025-04-06 18:12:10.856 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/chats/pinned HTTP/1.1" 200 - {} 2025-04-06 18:12:10.926 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/version/updates HTTP/1.1" 200 - {} 2025-04-06 18:12:10.945 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/folders/ HTTP/1.1" 200 - {} 2025-04-06 18:12:10.960 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/chats/?page=1 HTTP/1.1" 200 - {} 2025-04-06 18:12:11.286 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 2a01:cb0c:889f:7200:91d:d8a5:9970:bff6:0 - "GET /api/v1/chats/?page=2 HTTP/1.1" 200 - {} ``` ### Additional Information - I am running open-webui behind a reverse proxy, Nginx Proxy Manager - I am using Authentik as an OAuth provider - I am running open-webui in a Portainer stack, with `open-webui`, `pipelines`, `litellm`, `postgres` as a db for litellm, and `litellm-exporter` to get prometheus metrics - This O-WUI instance is very experiments, as is the case for all services I run on my old-ass server (a '09 laptop' - Each time you see `DOMAIN`, i have censored my actual domain name. This domain name is proxied through cloudflare and uses cloudflare nameservers
GiteaMirror added the bug label 2026-04-25 06:03:08 -05:00
GiteaMirror commented 2026-04-25 06:03:10 -05:00
Author
Owner
Copy Link

@StNiosem commented on GitHub (Apr 7, 2025):

Switched to Caddy web Server, which did nothing to improve

<!-- gh-comment-id:2784079500 --> @StNiosem commented on GitHub (Apr 7, 2025): Switched to Caddy web Server, which did nothing to improve
GiteaMirror commented 2026-04-25 06:03:10 -05:00
Author
Owner
Copy Link

@StNiosem commented on GitHub (Apr 7, 2025):

For anyone facing the same issue, using Caddy Web Server, add this to your Caddyfile:

[OPENWEBUI_SUBDOMAIN] {
    reverse_proxy [YOUR_OPENWEBUI_IP]:[YOUR_OPENWEBUI_PORT]
    header X-Forwarded-Proto https # this is the important part
}
<!-- gh-comment-id:2784112782 --> @StNiosem commented on GitHub (Apr 7, 2025): For anyone facing the same issue, using Caddy Web Server, add this to your Caddyfile: ``` [OPENWEBUI_SUBDOMAIN] { reverse_proxy [YOUR_OPENWEBUI_IP]:[YOUR_OPENWEBUI_PORT] header X-Forwarded-Proto https # this is the important part } ```
GiteaMirror commented 2026-04-25 06:03:12 -05:00
Author
Owner
Copy Link

@ChandanTeekinavar commented on GitHub (Apr 24, 2025):

  • I was also having the same issue.
  • I am using dex OIDC.
  • I was accessing the open-webuim application with HTTPS but returns OAuth redirect URL as HTTP. So I was getting Unregistered redirect_uri ("http://...")
  • I am using gateway-API instead of Ingress.
  • I fixed it by using X-Forwarded-Proto: https header in my gateway-API HttpRoute file to force the application to use HTTPS for all URL generation.
  • It also woks with Ingress
<!-- gh-comment-id:2826462839 --> @ChandanTeekinavar commented on GitHub (Apr 24, 2025): - I was also having the same issue. - I am using dex OIDC. - I was accessing the open-webuim application with HTTPS but returns OAuth redirect URL as HTTP. So I was getting **Unregistered redirect_uri ("http://...")** - I am using gateway-API instead of Ingress. - I fixed it by using **X-Forwarded-Proto: https** header in my gateway-API HttpRoute file to force the application to use HTTPS for all URL generation. - It also woks with Ingress
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#32162
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?