[GH-ISSUE #23409] issue: OAuth authentication fails when provider uses redirects #58641

New Issue

GiteaMirror · 2026-05-05T23:37:03-05:00

GiteaMirror commented

2026-05-05 23:37:03 -05:00

Originally created by @olivier-lacroix on GitHub (Apr 5, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/23409

Bug Report

Check Existing Issues

I have searched for any existing and/or related issues.
I have searched for any existing and/or related discussions.
I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

v0.8.12

Operating System

Linux

Confirmation

I have read and followed all instructions in README.md.
I am using the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided every relevant configuration, setting, and environment variable used in my setup.
I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation.

Expected Behavior

OAuth authentication should complete successfully even if the OAuth provider's endpoints (e.g., token endpoint or user info endpoint) perform HTTP redirects.

Actual Behavior

The OAuth authentication flow fails with an error during the exchange or profile retrieval phase because the underlying HTTP client does not follow redirects by default. This results in a failure to obtain tokens or user information when the provider redirects the request.

Steps to Reproduce

Configure an OAuth provider in Open WebUI that uses redirects on its token or user info endpoints.
Attempt to sign in using this OAuth provider.
Observe that the authentication flow fails after the initial authorization step, typically when the backend attempts to communicate with the provider's API.

Logs & Screenshots

 httpx.HTTPStatusError: Redirect response '302 Found' for url 'https://mcp-server.egnyte.com/.well-known/oauth-authorization-server/mcp'"

Additional Information

The issue is caused by the OAuthClientManager not setting follow_redirects=True in the client_kwargs for the OAuth client. Enabling this option ensures that the HTTP client correctly handles redirects from OAuth providers.

Originally created by @olivier-lacroix on GitHub (Apr 5, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/23409 ### Bug Report #### Check Existing Issues - [x] I have searched for any existing and/or related issues. - [x] I have searched for any existing and/or related discussions. - [x] I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!). - [x] I am using the latest version of Open WebUI. #### Installation Method - Docker #### Open WebUI Version - v0.8.12 #### Operating System - Linux #### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [ ] I have included the browser console logs. - [ ] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. #### Expected Behavior OAuth authentication should complete successfully even if the OAuth provider's endpoints (e.g., token endpoint or user info endpoint) perform HTTP redirects. #### Actual Behavior The OAuth authentication flow fails with an error during the exchange or profile retrieval phase because the underlying HTTP client does not follow redirects by default. This results in a failure to obtain tokens or user information when the provider redirects the request. #### Steps to Reproduce 1. Configure an OAuth provider in Open WebUI that uses redirects on its token or user info endpoints. 2. Attempt to sign in using this OAuth provider. 3. Observe that the authentication flow fails after the initial authorization step, typically when the backend attempts to communicate with the provider's API. #### Logs & Screenshots ``` httpx.HTTPStatusError: Redirect response '302 Found' for url 'https://mcp-server.egnyte.com/.well-known/oauth-authorization-server/mcp'" ``` #### Additional Information The issue is caused by the `OAuthClientManager` not setting `follow_redirects=True` in the `client_kwargs` for the OAuth client. Enabling this option ensures that the HTTP client correctly handles redirects from OAuth providers.

GiteaMirror added the bug label 2026-05-05 23:37:03 -05:00

GiteaMirror closed this issue

2026-05-05 23:37:06 -05:00

GiteaMirror commented

2026-05-05 23:37:12 -05:00

@olivier-lacroix commented on GitHub (Apr 7, 2026):

Fox proposed in https://github.com/open-webui/open-webui/pull/23410

@olivier-lacroix commented on GitHub (Apr 7, 2026): Fox proposed in https://github.com/open-webui/open-webui/pull/23410

GiteaMirror commented

2026-05-05 23:37:14 -05:00

@tjbck commented on GitHub (Apr 13, 2026):

Addressed in dev.

@tjbck commented on GitHub (Apr 13, 2026): Addressed in dev.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#58641