github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-05-07 03:18:23 -05:00
Code Issues 1.3k Packages Projects Releases 126 Wiki Activity

[PR #20750] [CLOSED] fix: URL-encode OAuth client secrets to handle special characters #64619

New Issue
Closed
opened 2026-05-06 10:15:28 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-05-06 10:15:28 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/20750
Author: @YuriNachos
Created: 1/17/2026
Status: ❌ Closed

Base: dev ← Head: fix-20733-oauth-url-encoding

📝 Commits (1)

  • e4768a7 fix: URL-encode OAuth client secrets to handle special characters

📊 Changes

1 file changed (+6 additions, -6 deletions)

View changed files

📝 backend/open_webui/config.py (+6 -6)

📄 Description

Description

  • Fixes #20733 - OAuth client secrets with special characters fail authentication

Added

  • N/A

Changed

  • Applied urllib.parse.quote() with safe='' to all OAuth provider client secrets

Deprecated

  • N/A

Removed

  • N/A

Fixed

  • OAuth authentication: Fixed client secrets containing special characters (e.g., +) causing authentication failures
  • Special characters like + were not properly URL-encoded before being sent to the IdP
  • In application/x-www-form-urlencoded format, + is interpreted as space
  • Now all OAuth providers properly encode client secrets:
    • OAUTH_CLIENT_SECRET (OIDC)
    • GOOGLE_CLIENT_SECRET
    • MICROSOFT_CLIENT_SECRET
    • GITHUB_CLIENT_SECRET
    • FEISHU_CLIENT_SECRET

Security

  • N/A

Breaking Changes

  • N/A

Additional Information

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/20750 **Author:** [@YuriNachos](https://github.com/YuriNachos) **Created:** 1/17/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `fix-20733-oauth-url-encoding` --- ### 📝 Commits (1) - [`e4768a7`](https://github.com/open-webui/open-webui/commit/e4768a7c532d8855809873274714b7f96ceb0ca8) fix: URL-encode OAuth client secrets to handle special characters ### 📊 Changes **1 file changed** (+6 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/config.py` (+6 -6) </details> ### 📄 Description ### Description - Fixes #20733 - OAuth client secrets with special characters fail authentication ### Added - N/A ### Changed - Applied `urllib.parse.quote()` with `safe=''` to all OAuth provider client secrets ### Deprecated - N/A ### Removed - N/A ### Fixed - **OAuth authentication**: Fixed client secrets containing special characters (e.g., `+`) causing authentication failures - Special characters like `+` were not properly URL-encoded before being sent to the IdP - In `application/x-www-form-urlencoded` format, `+` is interpreted as space - Now all OAuth providers properly encode client secrets: - OAUTH_CLIENT_SECRET (OIDC) - GOOGLE_CLIENT_SECRET - MICROSOFT_CLIENT_SECRET - GITHUB_CLIENT_SECRET - FEISHU_CLIENT_SECRET ### Security - N/A ### Breaking Changes - N/A --- ### Additional Information - Issue: #20733 - Example: `helloworld+1234` is now properly encoded as `helloworld%2B1234` - Fixes OAuth login failures when client secrets contain special characters ### Contributor License Agreement By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-05-06 10:15:28 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#64619
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?