feat: Add CORS validation to WebSocket connections #6701

New Issue

GiteaMirror · 2025-11-11T17:03:46-06:00

GiteaMirror commented

2025-11-11 17:03:46 -06:00

Originally created by @ricdikulous on GitHub (Oct 18, 2025).

Check Existing Issues

I have searched all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request.

Problem Description

Open WebUI's WebSocket server does not enforce CORS (Cross-Origin Resource Sharing) origin validation on WebSocket connections. While WebSocket endpoints are protected by authentication mechanisms, they lack the same origin validation that HTTP endpoints have.

Without CORS validation on WebSockets, there's a potential attack vector for Cross-Site WebSocket Hijacking (CSWSH), where a malicious website could attempt to establish WebSocket connections if it somehow obtains valid authentication tokens (e.g. through XSS on a different subdomain, browser extensions, or other token leakage scenarios).

This is a defense-in-depth concern rather than an immediate vulnerability, but it represents a gap in the security layers that should be addressed for consistency and best practices.

Desired Solution you'd like

Add CORS origin validation to the WebSocket server configuration by utilizing the existing CORS_ALLOW_ORIGIN environment variable that's already used for HTTP endpoints.

Alternatives Considered

Leave as is

Additional Context

This was raised while we had a team do a thorough security review of Open WebUI

Originally created by @ricdikulous on GitHub (Oct 18, 2025). ### Check Existing Issues - [x] I have searched all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request. ### Problem Description Open WebUI's WebSocket server does not enforce CORS (Cross-Origin Resource Sharing) origin validation on WebSocket connections. While WebSocket endpoints are protected by authentication mechanisms, they lack the same origin validation that HTTP endpoints have. Without CORS validation on WebSockets, there's a potential attack vector for Cross-Site WebSocket Hijacking (CSWSH), where a malicious website could attempt to establish WebSocket connections if it somehow obtains valid authentication tokens (e.g. through XSS on a different subdomain, browser extensions, or other token leakage scenarios). This is a defense-in-depth concern rather than an immediate vulnerability, but it represents a gap in the security layers that should be addressed for consistency and best practices. ### Desired Solution you'd like Add CORS origin validation to the WebSocket server configuration by utilizing the existing `CORS_ALLOW_ORIGIN` environment variable that's already used for HTTP endpoints. ### Alternatives Considered Leave as is ### Additional Context This was raised while we had a team do a thorough security review of Open WebUI

GiteaMirror closed this issue

2025-11-11 17:03:46 -06:00

GiteaMirror referenced this issue

2025-11-11 18:04:33 -06:00

[PR #6701] [MERGED] Small Fix: variable from ssl_verification to: web_loader_ssl_verification #8732

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#6701