[PR #22071] [CLOSED] feat: add OAUTH_LOGOUT_URI for custom OAuth logout endpoints #65317

New Issue

GiteaMirror · 2026-05-06T11:06:17-05:00

GiteaMirror commented

2026-05-06 11:06:17 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/22071
Author: @Br1an67
Created: 3/1/2026
Status: ❌ Closed

Base: dev ← Head: feat/oauth-logout-uri

📝 Commits (1)

c5d0209 feat: add OAUTH_LOGOUT_URI for custom OAuth logout endpoints

📊 Changes

2 files changed (+18 additions, -1 deletions)

View changed files

📝 backend/open_webui/config.py (+7 -1)
📝 backend/open_webui/routers/auths.py (+11 -0)

📄 Description

Pull Request Checklist

Target branch: dev
Description: See below
Changelog: See below
Testing: Manually verified that the new config variable is picked up and the signout handler correctly redirects when OAUTH_LOGOUT_URI is set
Agentic AI Code: This PR has been reviewed and tested by a human
Code review: Self-reviewed
Git Hygiene: Single atomic commit

Changelog Entry

Description

Add a new OAUTH_LOGOUT_URI environment variable that allows specifying a full custom logout URI for OAuth providers that do not support the standard OIDC end_session_endpoint discovery (e.g. AWS Cognito).

Closes #19182

Added

OAUTH_LOGOUT_URI PersistentConfig in config.py — accepts a full custom logout URL via environment variable
Early return in the /signout handler: when OAUTH_LOGOUT_URI is set and an OAuth session exists, redirect to it directly instead of attempting OIDC discovery

Changed

Startup warning now also checks OAUTH_LOGOUT_URI — the "logout will not work" warning is suppressed when either OPENID_PROVIDER_URL or OAUTH_LOGOUT_URI is configured

Fixed

OAuth logout for providers like AWS Cognito that use a custom logout endpoint with different parameters (e.g. client_id + logout_uri) instead of the standard OIDC end_session_endpoint with id_token_hint

Additional Information

AWS Cognito requires a logout URL like https://<domain>/logout?client_id=<id>&logout_uri=<uri> — this cannot be discovered via OIDC metadata
The new variable is fully opt-in: when unset (default ""), the existing OIDC discovery flow is used unchanged
Only 2 files changed, 18 lines added

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/22071 **Author:** [@Br1an67](https://github.com/Br1an67) **Created:** 3/1/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `feat/oauth-logout-uri` --- ### 📝 Commits (1) - [`c5d0209`](https://github.com/open-webui/open-webui/commit/c5d0209d412d817fc2459acbdf5f8e733a8652c3) feat: add OAUTH_LOGOUT_URI for custom OAuth logout endpoints ### 📊 Changes **2 files changed** (+18 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/config.py` (+7 -1) 📝 `backend/open_webui/routers/auths.py` (+11 -0) </details> ### 📄 Description ## Pull Request Checklist - [x] **Target branch:** `dev` - [x] **Description:** See below - [x] **Changelog:** See below - [x] **Testing:** Manually verified that the new config variable is picked up and the signout handler correctly redirects when `OAUTH_LOGOUT_URI` is set - [x] **Agentic AI Code:** This PR has been reviewed and tested by a human - [x] **Code review:** Self-reviewed - [x] **Git Hygiene:** Single atomic commit # Changelog Entry ### Description Add a new `OAUTH_LOGOUT_URI` environment variable that allows specifying a full custom logout URI for OAuth providers that do not support the standard OIDC `end_session_endpoint` discovery (e.g. AWS Cognito). Closes #19182 ### Added - `OAUTH_LOGOUT_URI` PersistentConfig in `config.py` — accepts a full custom logout URL via environment variable - Early return in the `/signout` handler: when `OAUTH_LOGOUT_URI` is set and an OAuth session exists, redirect to it directly instead of attempting OIDC discovery ### Changed - Startup warning now also checks `OAUTH_LOGOUT_URI` — the "logout will not work" warning is suppressed when either `OPENID_PROVIDER_URL` or `OAUTH_LOGOUT_URI` is configured ### Fixed - OAuth logout for providers like AWS Cognito that use a custom logout endpoint with different parameters (e.g. `client_id` + `logout_uri`) instead of the standard OIDC `end_session_endpoint` with `id_token_hint` --- ### Additional Information - AWS Cognito requires a logout URL like `https://<domain>/logout?client_id=<id>&logout_uri=<uri>` — this cannot be discovered via OIDC metadata - The new variable is fully opt-in: when unset (default `""`), the existing OIDC discovery flow is used unchanged - Only 2 files changed, 18 lines added ### Contributor License Agreement By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-06 11:06:17 -05:00

GiteaMirror closed this issue

2026-05-06 11:06:19 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#65317