[GH-ISSUE #23666] Bug: tool listing never sets 'authenticated' flag for auth_type 'oauth_2.1_static' #35567

New Issue

GiteaMirror · 2026-04-25T09:45:31-05:00

GiteaMirror commented

2026-04-25 09:45:31 -05:00

Originally created by @dhruvalgupta2003 on GitHub (Apr 13, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/23666

Summary

In the MCP tool listing endpoint, the session-token lookup and the authenticated flag on the response are both gated on auth_type == 'oauth_2.1'. For servers with auth_type == 'oauth_2.1_static', the frontend never receives the authenticated key, so the OAuth status badge / re-auth button renders incorrectly (or not at all) for static-OAuth MCP servers.

Location

backend/open_webui/routers/tools.py — lines 123 and 151:

if auth_type == 'oauth_2.1':                      # line 123
    splits = server_id.split(':')
    server_id = splits[-1] if len(splits) > 1 else server_id
    session_token = await request.app.state.oauth_client_manager.get_oauth_token(
        user.id, f'mcp:{server_id}'
    )
...
**(
    {'authenticated': session_token is not None}
    if auth_type == 'oauth_2.1'                  # line 151
    else {}
),

Impact

Admin UI can't tell whether a static-OAuth MCP server is currently authorized; users can't discover that they need to (re-)authorize.

Suggested fix

Replace both checks with auth_type in ('oauth_2.1', 'oauth_2.1_static').

Originally created by @dhruvalgupta2003 on GitHub (Apr 13, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/23666 ### Summary In the MCP tool listing endpoint, the session-token lookup and the `authenticated` flag on the response are both gated on `auth_type == 'oauth_2.1'`. For servers with `auth_type == 'oauth_2.1_static'`, the frontend never receives the `authenticated` key, so the OAuth status badge / re-auth button renders incorrectly (or not at all) for static-OAuth MCP servers. ### Location `backend/open_webui/routers/tools.py` — lines 123 and 151: ```python if auth_type == 'oauth_2.1': # line 123 splits = server_id.split(':') server_id = splits[-1] if len(splits) > 1 else server_id session_token = await request.app.state.oauth_client_manager.get_oauth_token( user.id, f'mcp:{server_id}' ) ... **( {'authenticated': session_token is not None} if auth_type == 'oauth_2.1' # line 151 else {} ), ``` ### Impact Admin UI can't tell whether a static-OAuth MCP server is currently authorized; users can't discover that they need to (re-)authorize. ### Suggested fix Replace both checks with `auth_type in ('oauth_2.1', 'oauth_2.1_static')`.

GiteaMirror closed this issue

2026-04-25 09:45:31 -05:00

GiteaMirror commented

2026-04-25 09:45:32 -05:00

@tjbck commented on GitHub (Apr 13, 2026):

Already addressed in dev.

@tjbck commented on GitHub (Apr 13, 2026): Already addressed in dev.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#35567