OAuth logout functionality fails to remove cookies with external domain SSO #3413

New Issue

2025-11-11T15:31:17-06:00

GiteaMirror commented

2025-11-11 15:31:17 -06:00

Originally created by @TheDropZone on GitHub (Jan 24, 2025).

Bug Report

Installation Method

docker-compose deployment, with nginx proxy

Environment

Open WebUI Version: v0.5.4
Operating System: Ubuntu 20.04.6 LTS
Browser (if applicable): Chrome
Keycloak: 24.0

Expected Behavior:

When using keycloak as the OAuth provider, after logging in, I see token and oauth_id_token cookies stored in my browser for the open-webui domain. When I click signout in the UI, both "token" and "oauth_id_token" cookies are removed from my browser (on open-webui domain) and I am redirected to my keycloak signout endpoint where I am signed out of keycloak.

Based on work done in keycloak signout MR: https://github.com/open-webui/open-webui/pull/7678

Actual Behavior:

When using keycloak as the OAuth provider, after logging in, I see token and oauth_id_token cookies stored in my browser for the open-webui domain. When I click signout in the UI, I am redirected to my keycloak signout endpoint where I am signed out of keycloak, but I see an error on the network redirect and the "token" and "oauth_id_token" cookies are still registered in my browser for open-webui domain

Description

So, I've deployed this OAuth functionality alongside a keycloak instance, and am running into some issues with the cookie deletion when open-webui and keycloak live on different domains.

openwebui01-domain.com
kc01-domain.com
The cookies (token, oauth_id_token) live and are set on the open-webui domain (openwebui01-domain.com), but the signout url from keycloak (and the openid_config) is on kc01-domain.com. So, it seems that when the signout endpoint requests to delete the cookies (living on openwebui01) but then redirects to kc01-domain for signout, the cookies don't get deleted (due to cookie domain mismatch). Because I'm redirected to the kc01-domain for the signout, the cookies dont exist at that domain to be deleted, and token and oauth_id_token live forever.

Reproduction Details

Run open-webui (via docker) with OAuth configuration pointed at a keycloak instance with a client setup for oauth
Configure OAuth via environment variables

      - ENABLE_OAUTH_SIGNUP=True
      - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=True
      - OAUTH_CLIENT_ID=open-webui
      - OAUTH_CLIENT_SECRET=secret-here
      - OAUTH_PROVIDER_NAME=name-here
      - OAUTH_SCOPES=openid email roles
      - OPENID_PROVIDER_URL=https://kc01-domain.com/realms/your-realm/.well-known/openid-configuration
      - OPENID_REDIRECT_URI=https://openwebui01-domain.com/oauth/oidc/callback
      - ENABLE_OAUTH_ROLE_MANAGEMENT=False

Ensure keycloak has a valid client for that client-id at your-realm.
Sign into open-webui using oauth provider via chrome
Open chrome dev-tools and the application tab and check the cookies for your open-webui domain. Expect to see "token" and "oauth_id_token" cookie values
Click the signout button in the UI
Notice that you are redirected to your keycloak signout url, and signed out of keycloak. With your chrome dev tools still up, notice that the redirect request to logout is marked as red (but 200 ok) -> do to cookie issues
go back to your open-webui domain, open dev tools, check application tab and cookies for your open-webui domain. See the token and oauth_id_token cookies still remain.

Logs and Screenshots

Browser Console Logs:

Docker Container Logs:

INFO:     10.102.0.117:0 - "GET /api/v1/auths/signout HTTP/1.1" 307 Temporary Redirect

Additional Information

From initial debugging and adding log statements and such, I have validated that the signout code is executing correctly:
https://github.com/open-webui/open-webui/blob/main/backend/open_webui/routers/auths.py#L513

async def signout(request: Request, response: Response):
    response.delete_cookie("token")

    if ENABLE_OAUTH_SIGNUP.value:
        oauth_id_token = request.cookies.get("oauth_id_token")
        if oauth_id_token:
            try:
                async with ClientSession() as session:
                    async with session.get(OPENID_PROVIDER_URL.value) as resp:
                        if resp.status == 200:
                            openid_data = await resp.json()
                            logout_url = openid_data.get("end_session_endpoint")
                            if logout_url:
                                response.delete_cookie("oauth_id_token")
                                return RedirectResponse(
                                    url=f"{logout_url}?id_token_hint={oauth_id_token}"
                                )
                        else:
                            raise HTTPException(
                                status_code=resp.status,
                                detail="Failed to fetch OpenID configuration",
                            )
            except Exception as e:
                raise HTTPException(status_code=500, detail=str(e))

But, I have confirmed that the token and oauth_id_token values are stored on the open-webui domain, but the redirect sends me to the keycloak domain (which doesn't have the cookies, do to domain locking).

So, I'm not quite sure how to address this issue? It almost seems that the signout and cookie removal on open-webui would need to happen in a distinct and separate request chain than the logout call to keycloak?

Originally created by @TheDropZone on GitHub (Jan 24, 2025). # Bug Report ## Installation Method docker-compose deployment, with nginx proxy ## Environment - **Open WebUI Version:** v0.5.4 - **Operating System:** Ubuntu 20.04.6 LTS - **Browser (if applicable):** Chrome - **Keycloak:** 24.0 ## Expected Behavior: When using keycloak as the OAuth provider, after logging in, I see token and oauth_id_token cookies stored in my browser for the open-webui domain. When I click signout in the UI, both "token" and "oauth_id_token" cookies are removed from my browser (on open-webui domain) and I am redirected to my keycloak signout endpoint where I am signed out of keycloak. Based on work done in keycloak signout MR: https://github.com/open-webui/open-webui/pull/7678 ## Actual Behavior: When using keycloak as the OAuth provider, after logging in, I see token and oauth_id_token cookies stored in my browser for the open-webui domain. When I click signout in the UI, I am redirected to my keycloak signout endpoint where I am signed out of keycloak, but I see an error on the network redirect and the "token" and "oauth_id_token" cookies are still registered in my browser for open-webui domain ## Description So, I've deployed this OAuth functionality alongside a keycloak instance, and am running into some issues with the cookie deletion when open-webui and keycloak live on different domains. - openwebui01-domain.com - kc01-domain.com The cookies (token, oauth_id_token) live and are set on the open-webui domain (openwebui01-domain.com), but the signout url from keycloak (and the openid_config) is on kc01-domain.com. So, it seems that when the signout endpoint requests to delete the cookies (living on openwebui01) but then redirects to kc01-domain for signout, the cookies don't get deleted (due to cookie domain mismatch). Because I'm redirected to the kc01-domain for the signout, the cookies dont exist at that domain to be deleted, and token and oauth_id_token live forever. ## Reproduction Details 1. Run open-webui (via docker) with OAuth configuration pointed at a keycloak instance with a client setup for oauth 2. Configure OAuth via environment variables ``` - ENABLE_OAUTH_SIGNUP=True - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=True - OAUTH_CLIENT_ID=open-webui - OAUTH_CLIENT_SECRET=secret-here - OAUTH_PROVIDER_NAME=name-here - OAUTH_SCOPES=openid email roles - OPENID_PROVIDER_URL=https://kc01-domain.com/realms/your-realm/.well-known/openid-configuration - OPENID_REDIRECT_URI=https://openwebui01-domain.com/oauth/oidc/callback - ENABLE_OAUTH_ROLE_MANAGEMENT=False ``` 3. Ensure keycloak has a valid client for that client-id at your-realm. 4. Sign into open-webui using oauth provider via chrome 5. Open chrome dev-tools and the application tab and check the cookies for your open-webui domain. Expect to see "token" and "oauth_id_token" cookie values 6. Click the signout button in the UI 7. Notice that you are redirected to your keycloak signout url, and signed out of keycloak. With your chrome dev tools still up, notice that the redirect request to logout is marked as red (but 200 ok) -> do to cookie issues 8. go back to your open-webui domain, open dev tools, check application tab and cookies for your open-webui domain. See the token and oauth_id_token cookies still remain. ## Logs and Screenshots **Browser Console Logs:** ![Image](https://github.com/user-attachments/assets/2a45934f-ea47-425b-8056-59866d7f65a8) ![Image](https://github.com/user-attachments/assets/739efde8-4abe-4d8b-b181-7e5c5581a1a7) **Docker Container Logs:** ``` INFO: 10.102.0.117:0 - "GET /api/v1/auths/signout HTTP/1.1" 307 Temporary Redirect ``` ## Additional Information From initial debugging and adding log statements and such, I have validated that the signout code is executing correctly: https://github.com/open-webui/open-webui/blob/main/backend/open_webui/routers/auths.py#L513 ``` async def signout(request: Request, response: Response): response.delete_cookie("token") if ENABLE_OAUTH_SIGNUP.value: oauth_id_token = request.cookies.get("oauth_id_token") if oauth_id_token: try: async with ClientSession() as session: async with session.get(OPENID_PROVIDER_URL.value) as resp: if resp.status == 200: openid_data = await resp.json() logout_url = openid_data.get("end_session_endpoint") if logout_url: response.delete_cookie("oauth_id_token") return RedirectResponse( url=f"{logout_url}?id_token_hint={oauth_id_token}" ) else: raise HTTPException( status_code=resp.status, detail="Failed to fetch OpenID configuration", ) except Exception as e: raise HTTPException(status_code=500, detail=str(e)) ``` But, I have confirmed that the token and oauth_id_token values are stored on the open-webui domain, but the redirect sends me to the keycloak domain (which doesn't have the cookies, do to domain locking). So, I'm not quite sure how to address this issue? It almost seems that the signout and cookie removal on open-webui would need to happen in a distinct and separate request chain than the logout call to keycloak?

GiteaMirror closed this issue

2025-11-11 15:31:17 -06:00

GiteaMirror commented

2025-11-11 15:31:18 -06:00

@the-c0d3br34k3r commented on GitHub (Feb 9, 2025):

@TheDropZone, great job on documenting the steps in detail 🙌
It seems like a simple fix.
I've proposed the fix here

@the-c0d3br34k3r commented on GitHub (Feb 9, 2025): @TheDropZone, great job on documenting the steps in detail 🙌 It seems like a simple fix. I've proposed the fix [here](https://github.com/open-webui/open-webui/discussions/9679)

GiteaMirror commented

2025-11-11 15:31:18 -06:00