[GH-ISSUE #21820] issue: Full signout → signin cycle on every page refresh triggers rate limiter (429) #35109

New Issue

2026-04-25T09:19:09-05:00

GiteaMirror commented

2026-04-25 09:19:09 -05:00

Originally created by @wdepree on GitHub (Feb 24, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/21820

Check Existing Issues

I have searched for any existing and/or related issues.
I have searched for any existing and/or related discussions.
I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

v0.8.5

Ollama Version (if applicable)

No response

Operating System

Ubuntu (Azure Container Apps)

Browser (if applicable)

Microsoft Edge 145 / Chrome 145

Confirmation

I have read and followed all instructions in README.md.
I am using the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided every relevant configuration, setting, and environment variable used in my setup.
I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
Start with the initial platform/version/OS and dependencies used,
Specify exact install/launch/configure commands,
List URLs visited, user input (incl. example values/emails/passwords if needed),
Describe all options and toggles enabled or changed,
Include any files or environmental changes,
Identify the expected and actual result at each stage,
Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

On page refresh, the frontend should:

Check for an existing valid token in localStorage (or read from the HttpOnly cookie)
Verify the token with a lightweight API call
If valid → continue the session without re-authentication
If invalid → redirect to login page

No signout/signin cycle should occur on a simple page refresh.

Actual Behavior

On every page refresh:

Frontend calls signout (200)
Frontend calls POST /api/v1/auths/signin with plaintext email + password in the request body (200)
After 5 refreshes within 3 minutes → POST /api/v1/auths/signin returns 429 Too Many Requests
User is locked out until the rate limit window expires (Retry-After: ~97 seconds)

Steps to Reproduce

Log in to Open WebUI normally
Open DevTools → Network tab (enable "Preserve log")
Press F5 to refresh the page
Observe in the Network tab: a signout request followed by a signin POST request with full credentials (email + password in the request body)
Repeat F5 five more times within 3 minutes
On the 6th refresh: 429 Too Many Requests — user is locked out

Logs & Screenshots

Additional Information

No response

Originally created by @wdepree on GitHub (Feb 24, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/21820 ### Check Existing Issues - [x] I have searched for any existing and/or related issues. - [x] I have searched for any existing and/or related discussions. - [x] I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!). - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version v0.8.5 ### Ollama Version (if applicable) _No response_ ### Operating System Ubuntu (Azure Container Apps) ### Browser (if applicable) Microsoft Edge 145 / Chrome 145 ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior On page refresh, the frontend should: 1. Check for an existing valid token in localStorage (or read from the HttpOnly cookie) 2. Verify the token with a lightweight API call 3. If valid → continue the session without re-authentication 4. If invalid → redirect to login page No signout/signin cycle should occur on a simple page refresh. ### Actual Behavior On every page refresh: 1. Frontend calls signout (200) 2. Frontend calls POST /api/v1/auths/signin with plaintext email + password in the request body (200) 3. After 5 refreshes within 3 minutes → POST /api/v1/auths/signin returns 429 Too Many Requests 4. User is locked out until the rate limit window expires (Retry-After: ~97 seconds) ### Steps to Reproduce 1. Log in to Open WebUI normally 2. Open DevTools → Network tab (enable "Preserve log") 3. Press F5 to refresh the page 4. Observe in the Network tab: a signout request followed by a signin POST request with full credentials (email + password in the request body) 5. Repeat F5 five more times within 3 minutes 6. On the 6th refresh: 429 Too Many Requests — user is locked out ### Logs & Screenshots <img width="1729" height="1207" alt="Image" src="https://github.com/user-attachments/assets/66d674a8-143e-46c5-bb2a-79118400d480" /> ### Additional Information _No response_

GiteaMirror added the bug label 2026-04-25 09:19:09 -05:00

GiteaMirror closed this issue

2026-04-25 09:19:10 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#35109