[GH-ISSUE #20852] feat: Support Password Masking in UserValves #34842

New Issue

GiteaMirror · 2026-04-25T09:01:36-05:00

GiteaMirror commented

2026-04-25 09:01:36 -05:00

Originally created by @EliasBA on GitHub (Jan 21, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/20852

Check Existing Issues

I have searched for all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request.

Verify Feature Scope

I have read through and understood the scope definition for feature requests in the Issues section. I believe my feature request meets the definition and belongs in the Issues section instead of the Discussions.

Problem Description

When creating Tools or Functions with UserValves that contain sensitive fields like passwords, the password is displayed as plain text in the OpenWebUI settings UI.

This is a security concern because:

Passwords are visible on screen (shoulder surfing risk)
Passwords may be visible in screenshots
Users expect password fields to be masked in settings forms

Current Behavior:
The standard JSON Schema format: "password" attribute is not recognized by the Valves.svelte component.

class UserValves(BaseModel):
    exchange_password: str = Field(
        default="",
        description="Your Exchange/AD password",
        json_schema_extra={"format": "password"}  # <-- Currently IGNORED by the UI
    )

Desired Solution you'd like

Support the standard JSON Schema format: "password" attribute in Valves.svelte to render sensitive fields as password inputs (masked with dots).

OpenWebUI already has a SensitiveInput.svelte component. I propose modifying src/lib/components/common/Valves.svelte to use this existing component when the format is detected.

Implementation Logic:
Inside the valves rendering loop:

Check if valvesSpec.properties[property]?.format === 'password'
If true, render <SensitiveInput ... /> instead of the default <input type="text"> or <textarea>.

Alternatives Considered

Using "api_key" naming convention: We considered naming fields api_key to hope for auto-detection, but this is semantically incorrect for actual user passwords (e.g., database or service passwords).
Custom HTML in Description: Not supported/sanitized.
Doing nothing: Leaves credentials exposed in the UI.

Additional Context

Implementation Suggestion:
In src/lib/components/common/Valves.svelte, add this condition to the main rendering loop:

{:else if valvesSpec.properties[property]?.format === 'password'}
    <SensitiveInput
        placeholder={valvesSpec.properties[property]?.description ?? ''}
        bind:value={valves[property]}
    />

Benefits:

✅ Security: Passwords hidden from view by default.
✅ Standard: Uses standard Pydantic/JSON Schema format: "password".
✅ Easy: Low-effort change leveraging the existing content.

For Tool Developers:
They can simply add json_schema_extra={"format": "password"} to their Pydantic models.

Originally created by @EliasBA on GitHub (Jan 21, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/20852 ### Check Existing Issues - [x] I have searched for all existing **open AND closed** issues and discussions for similar requests. I have found none that is comparable to my request. ### Verify Feature Scope - [x] I have read through and understood the scope definition for feature requests in the Issues section. I believe my feature request meets the definition and belongs in the Issues section instead of the Discussions. ### Problem Description When creating Tools or Functions with `UserValves` that contain sensitive fields like passwords, the password is displayed as **plain text** in the OpenWebUI settings UI. This is a security concern because: - Passwords are visible on screen (shoulder surfing risk) - Passwords may be visible in screenshots - Users expect password fields to be masked in settings forms **Current Behavior:** The standard JSON Schema `format: "password"` attribute is **not recognized** by the `Valves.svelte` component. ```python class UserValves(BaseModel): exchange_password: str = Field( default="", description="Your Exchange/AD password", json_schema_extra={"format": "password"} # <-- Currently IGNORED by the UI ) ``` ### Desired Solution you'd like Support the standard JSON Schema `format: "password"` attribute in `Valves.svelte` to render sensitive fields as password inputs (masked with dots). OpenWebUI already has a `SensitiveInput.svelte` component. I propose modifying `src/lib/components/common/Valves.svelte` to use this existing component when the format is detected. **Implementation Logic:** Inside the valves rendering loop: 1. Check if `valvesSpec.properties[property]?.format === 'password'` 2. If true, render `<SensitiveInput ... />` instead of the default `<input type="text">` or `<textarea>`. ### Alternatives Considered - **Using "api_key" naming convention:** We considered naming fields `api_key` to hope for auto-detection, but this is semantically incorrect for actual user passwords (e.g., database or service passwords). - **Custom HTML in Description:** Not supported/sanitized. - **Doing nothing:** Leaves credentials exposed in the UI. ### Additional Context **Implementation Suggestion:** In `src/lib/components/common/Valves.svelte`, add this condition to the main rendering loop: ```svelte {:else if valvesSpec.properties[property]?.format === 'password'} <SensitiveInput placeholder={valvesSpec.properties[property]?.description ?? ''} bind:value={valves[property]} /> ``` **Benefits:** - ✅ **Security:** Passwords hidden from view by default. - ✅ **Standard:** Uses standard Pydantic/JSON Schema `format: "password"`. - ✅ **Easy:** Low-effort change leveraging the existing content. **For Tool Developers:** They can simply add `json_schema_extra={"format": "password"}` to their Pydantic models.

GiteaMirror closed this issue

2026-04-25 09:01:38 -05:00

GiteaMirror commented

2026-04-25 09:01:39 -05:00

@tjbck commented on GitHub (Jan 21, 2026):

Addressed with 8c70453b2e in dev!

@tjbck commented on GitHub (Jan 21, 2026): Addressed with 8c70453b2e3a6958437d951751e84acbbaafd9aa in dev!

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#34842