[PR #23790] [CLOSED] fix(terminals): mirror HTTP auth modes in websocket terminal proxy #42999

New Issue

GiteaMirror · 2026-04-25T14:44:08-05:00

GiteaMirror commented

2026-04-25 14:44:08 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/23790
Author: @shaun0927
Created: 4/16/2026
Status: ❌ Closed

Base: dev ← Head: fix-terminal-ws-auth

📝 Commits (2)

cf81ae8 Keep terminal websocket auth aligned with the HTTP proxy
af20f85 Keep websocket session auth tied to the validated login token

📊 Changes

3 files changed (+174 additions, -41 deletions)

View changed files

📝 backend/open_webui/routers/terminals.py (+22 -41)
➕ backend/open_webui/test/util/test_terminals.py (+102 -0)
➕ backend/open_webui/utils/terminals.py (+50 -0)

📄 Description

Terminal connections already advertise multiple auth modes, and proxy_terminal forwards bearer, session, and system_oauth credentials. ws_terminal only sent an upstream auth frame for bearer, so session-backed and OAuth-backed terminal connections had no equivalent upstream auth material on the websocket path.

This extracts the terminal auth assembly into a shared helper and reuses it for both the HTTP proxy and the websocket handshake. The websocket keeps the existing bearer auth frame and now sends the same handshake headers/cookies used by the HTTP proxy for the other auth modes.

Related: #23788

Testing

python3 -m py_compile backend/open_webui/routers/terminals.py backend/open_webui/utils/terminals.py
PYTHONPATH=backend PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 pytest -q backend/open_webui/test/util/test_terminals.py
local source-faithful harness showing that the old websocket logic sent an auth frame for bearer but nothing for session or system_oauth

Changelog Entry

Description

keep terminal websocket auth behavior aligned with the terminal HTTP proxy

Added

focused terminal auth helper tests for bearer, session, and system_oauth modes

Fixed

terminal websocket handshakes now reuse the same auth assembly as the HTTP proxy instead of silently dropping non-bearer modes

Additional Information

This is distinct from #22581 (ws:// vs wss:// under HTTPS).
There was a nearby closed PR (#23603) on terminal websocket auth; this keeps the scope narrow and fixes the current main mismatch between proxy_terminal and ws_terminal.

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

Note

Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/23790 **Author:** [@shaun0927](https://github.com/shaun0927) **Created:** 4/16/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `fix-terminal-ws-auth` --- ### 📝 Commits (2) - [`cf81ae8`](https://github.com/open-webui/open-webui/commit/cf81ae8f4a648d4dc2a0e21d34fe8940045c773f) Keep terminal websocket auth aligned with the HTTP proxy - [`af20f85`](https://github.com/open-webui/open-webui/commit/af20f851da601dcff06acae7f26fd67a3088cb80) Keep websocket session auth tied to the validated login token ### 📊 Changes **3 files changed** (+174 additions, -41 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/routers/terminals.py` (+22 -41) ➕ `backend/open_webui/test/util/test_terminals.py` (+102 -0) ➕ `backend/open_webui/utils/terminals.py` (+50 -0) </details> ### 📄 Description Terminal connections already advertise multiple auth modes, and `proxy_terminal` forwards bearer, session, and system_oauth credentials. `ws_terminal` only sent an upstream auth frame for bearer, so session-backed and OAuth-backed terminal connections had no equivalent upstream auth material on the websocket path. This extracts the terminal auth assembly into a shared helper and reuses it for both the HTTP proxy and the websocket handshake. The websocket keeps the existing bearer auth frame and now sends the same handshake headers/cookies used by the HTTP proxy for the other auth modes. Related: #23788 ### Testing - `python3 -m py_compile backend/open_webui/routers/terminals.py backend/open_webui/utils/terminals.py` - `PYTHONPATH=backend PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 pytest -q backend/open_webui/test/util/test_terminals.py` - local source-faithful harness showing that the old websocket logic sent an auth frame for `bearer` but nothing for `session` or `system_oauth` # Changelog Entry ### Description - keep terminal websocket auth behavior aligned with the terminal HTTP proxy ### Added - focused terminal auth helper tests for bearer, session, and system_oauth modes ### Fixed - terminal websocket handshakes now reuse the same auth assembly as the HTTP proxy instead of silently dropping non-bearer modes ### Additional Information - This is distinct from `#22581` (`ws://` vs `wss://` under HTTPS). - There was a nearby closed PR (`#23603`) on terminal websocket auth; this keeps the scope narrow and fixes the current `main` mismatch between `proxy_terminal` and `ws_terminal`. ### Contributor License Agreement  - [X] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. > [!NOTE] > Deleting the CLA section will lead to immediate closure of your PR and it will not be merged in. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-25 14:44:08 -05:00

GiteaMirror closed this issue

2026-04-25 14:44:09 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#42999