github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-03-12 18:14:16 -05:00
Code Issues 308 Packages Projects Releases 100 Wiki Activity

feat: one time password reset token #800

New Issue
Closed
opened 2025-11-11 14:31:31 -06:00 by GiteaMirror · 3 comments
GiteaMirror commented 2025-11-11 14:31:31 -06:00
Owner
Copy Link

Originally created by @qrkourier on GitHub (May 3, 2024).

Originally assigned to: @tjbck on GitHub.

Is your feature request related to a problem? Please describe.
A forgotten password forces the user to create a new account or the admin to share a new password. There's no way for a user with a forgotten password to have a password unknown to the admin.

Describe the solution you'd like
The user contacts the admin for help. In the admin panel, the admin clicks to obtain a one-time account reset token. The token is provided to the user who uses it to authenticate and is prompted to set a new password.

Describe alternatives you've considered
Send a password reset email upon request to the account address, if it exists. The email contains a one-time password presented as a pastable token and a clickable hyperlink . The OTP is valid for a few minutes. This would work, but most people don't want to set up an SMTP account, and I reckon most open-webui instances do not represent such a large number of users that self-service is truly necessary. Though, this would serve those admins with many users.

Additional context
Account life cycle events present opportunities for external attacks and admin overreach. The privacy-oriented user will appreciate having the option to choose between optimizing for chat preservation or chat privacy. For example, the default option could be to destroy chats if the password is administratively reset, thereby removing a convenient vector for attack or admin snooping (but not all vectors).

Originally created by @qrkourier on GitHub (May 3, 2024). Originally assigned to: @tjbck on GitHub. **Is your feature request related to a problem? Please describe.** A forgotten password forces the user to create a new account or the admin to share a new password. There's no way for a user with a forgotten password to have a password unknown to the admin. **Describe the solution you'd like** The user contacts the admin for help. In the admin panel, the admin clicks to obtain a one-time account reset token. The token is provided to the user who uses it to authenticate and is prompted to set a new password. **Describe alternatives you've considered** Send a password reset email upon request to the account address, if it exists. The email contains a one-time password presented as a pastable token and a clickable hyperlink . The OTP is valid for a few minutes. This would work, but most people don't want to set up an SMTP account, and I reckon most open-webui instances do not represent such a large number of users that self-service is truly necessary. Though, this would serve those admins with many users. **Additional context** Account life cycle events present opportunities for external attacks and admin overreach. The privacy-oriented user will appreciate having the option to choose between optimizing for chat preservation or chat privacy. For example, the default option could be to destroy chats if the password is administratively reset, thereby removing a convenient vector for attack or admin snooping (but not all vectors).
GiteaMirror commented 2025-11-11 14:31:32 -06:00
Author
Owner
Copy Link

@qrkourier commented on GitHub (May 4, 2024):

I overlooked a feature that solves this for me. The user can reset their password after admin sets it.

It would be better if the admin set pw was single use, forcing the user to choose a new secret immediately, avoiding the persistence of a shared (compromised) secret.

The self service email method would still be useful for larger instances with many users.

@qrkourier commented on GitHub (May 4, 2024): I overlooked a feature that solves this for me. The user can reset their password after admin sets it. It would be better if the admin set pw was single use, forcing the user to choose a new secret immediately, avoiding the persistence of a shared (compromised) secret. The self service email method would still be useful for larger instances with many users.
GiteaMirror commented 2025-11-11 14:31:32 -06:00
Author
Owner
Copy Link

@juliojesusvizcaino commented on GitHub (May 6, 2024):

I'm working on a solution for email-based password recovery.

It is a draft, but it already works (if configured correctly). I haven't tested it in docker yet, later today.

It's currently in a fork, but I'd be happy to merge it upstream.

https://github.com/open-webui/open-webui/pull/2003

@juliojesusvizcaino commented on GitHub (May 6, 2024): I'm working on a solution for email-based password recovery. It is a draft, but it already works (if configured correctly). I haven't tested it in docker yet, later today. It's currently in a fork, but I'd be happy to merge it upstream. https://github.com/open-webui/open-webui/pull/2003
GiteaMirror commented 2025-11-11 14:31:32 -06:00
Author
Owner
Copy Link

@tjbck commented on GitHub (Dec 2, 2024):

Closing in favour of #7545

@tjbck commented on GitHub (Dec 2, 2024): Closing in favour of #7545
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#800
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?