[PR #613] [CLOSED] Improve session security #7189

New Issue

GiteaMirror · 2025-11-11T17:19:40-06:00

GiteaMirror commented

2025-11-11 17:19:40 -06:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/613
Author: @explorigin
Created: 2/1/2024
Status: ❌ Closed

Base: main ← Head: session-security

📝 Commits (10+)

98f4f5a Merge pull request #411 from ollama-webui/latex-render-fix
1f930fa feat: rag api endpoint
0d260fa feat: chromadb vector store api
9dd270c feat: pdf data load
f69dbf9 feat: rag apis added to frontend
b280a03 feat: frontend file upload support
caf6999 doc: features update
20a6f81 feat: full integration
2a7cfee doc: feature wording update
9abb1cf fix: file message styling

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 backend/start.sh (+1 -1)

📄 Description

This PR changes a few things around how sessions are handled in order to improve security.

Problem 1: The session secret is hard-coded. Few people will provide their own thus the security of the whole project is a risk for everyone who deploys it.

Solution: One first run, the start script generates a randomly generated session key and stores it to a file. If no secret key is provided, the start script will grab this one. WEBUI_JWT_SECRET_KEY is still accepted. I flagged the line in config.py to be deprecated in the next major release.

Problem 2: JWT signatures were not verified. This makes session stealing easy.

Solution: Remove the option turning off jwt signature verification.

Problem 3: JWTs use email address as the primary method to identify a user. This makes step 2 involve no guesswork at all. If you know someone has session, you can just build the correctly formed JWT and BE them.

Solution: Use database user ids in the JWT instead.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/613 **Author:** [@explorigin](https://github.com/explorigin) **Created:** 2/1/2024 **Status:** ❌ Closed **Base:** `main` ← **Head:** `session-security` --- ### 📝 Commits (10+) - [`98f4f5a`](https://github.com/open-webui/open-webui/commit/98f4f5a0dd5c8068b46b49248b9c3084b66a9588) Merge pull request #411 from ollama-webui/latex-render-fix - [`1f930fa`](https://github.com/open-webui/open-webui/commit/1f930fa15dabee1cfe2bfb6bcc6564c8e271f50a) feat: rag api endpoint - [`0d260fa`](https://github.com/open-webui/open-webui/commit/0d260fa0238bc52d624a3a4de4346f18128d61f9) feat: chromadb vector store api - [`9dd270c`](https://github.com/open-webui/open-webui/commit/9dd270ce7f291497a7b7f8361ba49fd9ecc0a2e4) feat: pdf data load - [`f69dbf9`](https://github.com/open-webui/open-webui/commit/f69dbf9c242202a55e0bd5491129e42bff4314b1) feat: rag apis added to frontend - [`b280a03`](https://github.com/open-webui/open-webui/commit/b280a03c9b91a8e9bc9fd938ee24f425761dd690) feat: frontend file upload support - [`caf6999`](https://github.com/open-webui/open-webui/commit/caf6999fdd811a31e38453498b39169d205981b6) doc: features update - [`20a6f81`](https://github.com/open-webui/open-webui/commit/20a6f81e3bf0b880c33dfa7cabc101cdeff39349) feat: full integration - [`2a7cfee`](https://github.com/open-webui/open-webui/commit/2a7cfee15130ad86c8a1a8e7ea4c12f76895b0be) doc: feature wording update - [`9abb1cf`](https://github.com/open-webui/open-webui/commit/9abb1cffd21890b8a5f5b261f659198d0738453b) fix: file message styling ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `backend/start.sh` (+1 -1) </details> ### 📄 Description This PR changes a few things around how sessions are handled in order to improve security. Problem 1: The session secret is hard-coded. Few people will provide their own thus the security of the whole project is a risk for everyone who deploys it. Solution: One first run, the start script generates a randomly generated session key and stores it to a file. If no secret key is provided, the start script will grab this one. **WEBUI_JWT_SECRET_KEY** is still accepted. I flagged the line in config.py to be deprecated in the next major release. Problem 2: JWT signatures were not verified. This makes session stealing easy. Solution: Remove the option turning off jwt signature verification. Problem 3: JWTs use email address as the primary method to identify a user. This makes step 2 involve no guesswork at all. If you know someone has session, you can just build the correctly formed JWT and BE them. Solution: Use database user ids in the JWT instead. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-11 17:19:40 -06:00

GiteaMirror closed this issue

2025-11-11 17:19:40 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#7189