[GH-ISSUE #23665] Bug: MCP servers with auth_type 'oauth_2.1_static' never receive Bearer token (middleware gap) #35566

New Issue

GiteaMirror · 2026-04-25T09:45:30-05:00

GiteaMirror commented

2026-04-25 09:45:30 -05:00

Originally created by @dhruvalgupta2003 on GitHub (Apr 13, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/23665

Summary

When an MCP tool server is configured with auth_type: oauth_2.1_static, requests to that server are sent without an Authorization header, so every call fails (401 from the protected resource). This effectively breaks the static-OAuth MCP integration end-to-end — reproducible against Microsoft Entra ID / M365 MCP servers.

Introduced alongside oauth_2.1_static support (commit 601bb7835 feat: oauth 2.1 static mcp).

Location

backend/open_webui/utils/middleware.py around lines 2497–2523.

The auth-type dispatch handles bearer, none, session, system_oauth, and oauth_2.1 — but not oauth_2.1_static:

elif auth_type == 'oauth_2.1':
    try:
        splits = server_id.split(':')
        server_id = splits[-1] if len(splits) > 1 else server_id
        oauth_token = await request.app.state.oauth_client_manager.get_oauth_token(
            user.id, f'mcp:{server_id}'
        )
        if oauth_token:
            headers['Authorization'] = f'Bearer {oauth_token.get("access_token", "")}'
    except Exception as e:
        log.error(f'Error getting OAuth token: {e}')
        oauth_token = None
# <-- no elif for 'oauth_2.1_static'

Other parts of the codebase already group the two types together — e.g. main.py:2264, configs.py:181,204,365, and utils/oauth.py:567 all use in ('oauth_2.1', 'oauth_2.1_static'). The middleware branch is the outlier.

Impact

Critical — static-OAuth MCP servers cannot make a single authenticated request.
Silent failure: the admin sees only a downstream 401 / "failed to connect" error, nothing about the missing header.

Suggested fix

elif auth_type in ('oauth_2.1', 'oauth_2.1_static'):
    ...

Originally created by @dhruvalgupta2003 on GitHub (Apr 13, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/23665 ### Summary When an MCP tool server is configured with `auth_type: oauth_2.1_static`, requests to that server are sent **without an `Authorization` header**, so every call fails (401 from the protected resource). This effectively breaks the static-OAuth MCP integration end-to-end — reproducible against Microsoft Entra ID / M365 MCP servers. Introduced alongside `oauth_2.1_static` support (commit `601bb7835 feat: oauth 2.1 static mcp`). ### Location `backend/open_webui/utils/middleware.py` around lines 2497–2523. The auth-type dispatch handles `bearer`, `none`, `session`, `system_oauth`, and `oauth_2.1` — but **not** `oauth_2.1_static`: ```python elif auth_type == 'oauth_2.1': try: splits = server_id.split(':') server_id = splits[-1] if len(splits) > 1 else server_id oauth_token = await request.app.state.oauth_client_manager.get_oauth_token( user.id, f'mcp:{server_id}' ) if oauth_token: headers['Authorization'] = f'Bearer {oauth_token.get("access_token", "")}' except Exception as e: log.error(f'Error getting OAuth token: {e}') oauth_token = None # <-- no elif for 'oauth_2.1_static' ``` Other parts of the codebase already group the two types together — e.g. `main.py:2264`, `configs.py:181,204,365`, and `utils/oauth.py:567` all use `in ('oauth_2.1', 'oauth_2.1_static')`. The middleware branch is the outlier. ### Impact - **Critical** — static-OAuth MCP servers cannot make a single authenticated request. - Silent failure: the admin sees only a downstream 401 / "failed to connect" error, nothing about the missing header. ### Suggested fix ```python elif auth_type in ('oauth_2.1', 'oauth_2.1_static'): ... ```

GiteaMirror closed this issue

2026-04-25 09:45:30 -05:00

GiteaMirror commented

2026-04-25 09:45:31 -05:00

@tjbck commented on GitHub (Apr 13, 2026):

Already addressed in dev.

@tjbck commented on GitHub (Apr 13, 2026): Already addressed in dev.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#35566