[PR #23513] [CLOSED] fix: remove undefined cookie_expires from OAuth session cookie #42859

New Issue

GiteaMirror · 2026-04-25T14:38:22-05:00

GiteaMirror commented

2026-04-25 14:38:22 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/23513
Author: @rapartlu
Created: 4/8/2026
Status: ❌ Closed

Base: main ← Head: fix/oauth-session-cookie-expires

📝 Commits (1)

4b2caac Fix: remove undefined cookie_expires from OAuth session cookie

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 backend/open_webui/utils/oauth.py (+1 -1)

📄 Description

Bug

handle_callback in oauth.py (line 1686) references cookie_expires when setting the oauth_session_id cookie, but this variable is never defined. This causes a NameError that silently prevents OAuth sessions from being stored server-side.

Error: Failed to store OAuth session server-side: name 'cookie_expires' is not defined

This breaks:

system_oauth auth type for OpenAI connections (no session to read the token from)
Any feature that depends on the OAuth session being stored

Fix

Remove cookie_expires from the dict spread. cookie_max_age (which IS defined at line 1627) is sufficient and is the standard way to set cookie expiry. All other set_cookie calls in the same function correctly use only cookie_max_age.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/23513 **Author:** [@rapartlu](https://github.com/rapartlu) **Created:** 4/8/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/oauth-session-cookie-expires` --- ### 📝 Commits (1) - [`4b2caac`](https://github.com/open-webui/open-webui/commit/4b2caac60ead1fdb404d423670558d4951992898) Fix: remove undefined cookie_expires from OAuth session cookie ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/utils/oauth.py` (+1 -1) </details> ### 📄 Description ## Bug handle_callback in oauth.py (line 1686) references cookie_expires when setting the oauth_session_id cookie, but this variable is never defined. This causes a NameError that silently prevents OAuth sessions from being stored server-side. Error: Failed to store OAuth session server-side: name 'cookie_expires' is not defined This breaks: - system_oauth auth type for OpenAI connections (no session to read the token from) - Any feature that depends on the OAuth session being stored ## Fix Remove cookie_expires from the dict spread. cookie_max_age (which IS defined at line 1627) is sufficient and is the standard way to set cookie expiry. All other set_cookie calls in the same function correctly use only cookie_max_age. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-25 14:38:22 -05:00

GiteaMirror closed this issue

2026-04-25 14:38:25 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#42859