Feature Request: Temporary Login Links #3986

New Issue

2025-11-11T15:43:51-06:00

GiteaMirror commented

2025-11-11 15:43:51 -06:00

Originally created by @virtualarkansas on GitHub (Feb 20, 2025).

Feature Request

Is your feature request related to a problem? Please describe.
I've been working on integrating Open WebUI with our existing authentication system, and I've encountered a limitation. Our system already handles user authentication, but we're unable to seamlessly transition these verified users into Open WebUI. I initially tried working around this by implementing various authentication methods, but none have proven satisfactory.

Describe the solution you'd like
I'm hoping we can implement an API endpoint for generating temporary login links. The concept is straightforward: an administrative user with a valid API key should be able to request a temporary login link for any user through the API. This would allow our backend system to handle the authentication flow and redirect the user to the login link.

The implementation would need to:

Accept a user identifier and optional expiration time
Return a secure, time-limited URL for OpenWebUI access
Invalidate the link after its first use or when it expires

This would solve our immediate need while maintaining security standards. I've thought through the security implications, and this approach would actually be more secure than several of our current workarounds.

Describe alternatives you've considered
I've explored several alternatives, but each has significant drawbacks:

I considered implementing client-side token passing, but this proved both complex and potentially insecure. I then looked into shared session cookies, but this is difficult given the new cookie restrictions browsers are implementing.

Additional context
Our goal is for our users to seamlessly log in to an embedded instance.

Originally created by @virtualarkansas on GitHub (Feb 20, 2025). # Feature Request **Is your feature request related to a problem? Please describe.** I've been working on integrating Open WebUI with our existing authentication system, and I've encountered a limitation. Our system already handles user authentication, but we're unable to seamlessly transition these verified users into Open WebUI. I initially tried working around this by implementing various authentication methods, but none have proven satisfactory. **Describe the solution you'd like** I'm hoping we can implement an API endpoint for generating temporary login links. The concept is straightforward: an administrative user with a valid API key should be able to request a temporary login link for any user through the API. This would allow our backend system to handle the authentication flow and redirect the user to the login link. The implementation would need to: 1. Accept a user identifier and optional expiration time 2. Return a secure, time-limited URL for OpenWebUI access 3. Invalidate the link after its first use or when it expires This would solve our immediate need while maintaining security standards. I've thought through the security implications, and this approach would actually be more secure than several of our current workarounds. **Describe alternatives you've considered** I've explored several alternatives, but each has significant drawbacks: I considered implementing client-side token passing, but this proved both complex and potentially insecure. I then looked into shared session cookies, but this is difficult given the new cookie restrictions browsers are implementing. **Additional context** Our goal is for our users to seamlessly log in to an embedded instance.

GiteaMirror closed this issue

2025-11-11 15:43:51 -06:00

GiteaMirror referenced this issue

2026-04-19 20:11:17 -05:00

[GH-ISSUE #3986] RAG fails when documents increase #13455

GiteaMirror referenced this issue

2026-04-25 03:27:59 -05:00

[GH-ISSUE #3986] RAG fails when documents increase #28983

GiteaMirror referenced this issue

2026-05-05 13:17:24 -05:00

[GH-ISSUE #3986] RAG fails when documents increase #52121

GiteaMirror referenced this issue