github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-11-09 10:50:35 -06:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

[GH-ISSUE #14181] issue: Default value for CORS_ALLOW_ORIGIN conflict with credentials settings in CORSMiddleware #87914

New Issue
Closed
opened 2026-05-15 12:22:21 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-05-15 12:22:21 -05:00
Owner
Copy Link
Copy Source

Originally created by @wtarit on GitHub (May 22, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/14181

Check Existing Issues

  • I have searched the existing issues and discussions.
  • I am using the latest version of Open WebUI.

Installation Method

Git Clone

Open WebUI Version

v0.6.10

Ollama Version (if applicable)

No response

Operating System

Linux (WSL2, Ubuntu 24.04)

Browser (if applicable)

No response

Confirmation

  • I have read and followed all instructions in README.md.
  • I am using the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have listed steps to reproduce the bug in detail.

Expected Behavior

When launching Open WebUI for the first time it should go to the Welcome/Get Started page.

Actual Behavior

I got an error page with the error message Open WebUI Backend Required.

Steps to Reproduce

  1. Follow the Local Development Guide to install the dependencies.
  2. Launch the frontend with npm run dev and backend with sh dev.sh.
  3. Navigate to http://localhost:5173/

Logs & Screenshots

Image

Additional Information

It seems that by not setting CORS_ALLOW_ORIGIN environment variable, the CORS_ALLOW_ORIGIN default to "*;http://localhost:5173;http://localhost:8080" (config.py#L1275)

This is problematic because when allow_credentials=True is set (main.py#L1009), the wildcard "*" is not allowed according to FastAPI's documentation. This creates a conflict in the CORS configuration, causing the CORS error.

The default value for allow_origins shouldn't include wildcard to prevent conflict.

Originally created by @wtarit on GitHub (May 22, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/14181 ### Check Existing Issues - [x] I have searched the existing issues and discussions. - [x] I am using the latest version of Open WebUI. ### Installation Method Git Clone ### Open WebUI Version v0.6.10 ### Ollama Version (if applicable) _No response_ ### Operating System Linux (WSL2, Ubuntu 24.04) ### Browser (if applicable) _No response_ ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [ ] I have included the Docker container logs. - [x] I have listed steps to reproduce the bug in detail. ### Expected Behavior When launching Open WebUI for the first time it should go to the Welcome/Get Started page. ### Actual Behavior I got an error page with the error message `Open WebUI Backend Required`. ### Steps to Reproduce 1. Follow the [Local Development Guide](https://docs.openwebui.com/getting-started/advanced-topics/development) to install the dependencies. 2. Launch the frontend with `npm run dev` and backend with `sh dev.sh`. 3. Navigate to `http://localhost:5173/` ### Logs & Screenshots ![Image](https://github.com/user-attachments/assets/19cb79ae-eb65-49ca-878b-bc485e0a9f82) ### Additional Information It seems that by not setting `CORS_ALLOW_ORIGIN` environment variable, the `CORS_ALLOW_ORIGIN` default to "*;http://localhost:5173;http://localhost:8080" ([config.py#L1275](https://github.com/open-webui/open-webui/blob/main/backend/open_webui/config.py#L1275)) This is problematic because when `allow_credentials=True` is set ([main.py#L1009](https://github.com/open-webui/open-webui/blob/main/backend/open_webui/main.py#L1009)), the wildcard `"*"` is not allowed according to [FastAPI's documentation](https://fastapi.tiangolo.com/tutorial/cors/#use-corsmiddleware:~:text=.-,allow_credentials,for%20credentials%20to%20be%20allowed%2C%20origins%20must%20be%20specified.,-expose_headers). This creates a conflict in the CORS configuration, causing the CORS error. The default value for allow_origins shouldn't include wildcard to prevent conflict.
GiteaMirror added the bug label 2026-05-15 12:22:21 -05:00
GiteaMirror commented 2026-05-15 12:22:24 -05:00
Author
Owner
Copy Link
Copy Source

@GuilhermeCorsino21 commented on GitHub (May 23, 2025):

how to fix that? the same error here

<!-- gh-comment-id:2906008859 --> @GuilhermeCorsino21 commented on GitHub (May 23, 2025): how to fix that? the same error here
GiteaMirror commented 2026-05-15 12:22:25 -05:00
Author
Owner
Copy Link
Copy Source

@JovinLim commented on GitHub (Jun 7, 2025):

Go into open-webui/backend/open_webui/config.py and look for this:

CORS_ALLOW_ORIGIN = os.environ.get(
    "CORS_ALLOW_ORIGIN", "*;http://localhost:5173;http://localhost:8080"
).split(";")

Remove the first *; and it should work. I ran into the same problem and fixed it this way

<!-- gh-comment-id:2952525693 --> @JovinLim commented on GitHub (Jun 7, 2025): Go into open-webui/backend/open_webui/config.py and look for this: ``` CORS_ALLOW_ORIGIN = os.environ.get( "CORS_ALLOW_ORIGIN", "*;http://localhost:5173;http://localhost:8080" ).split(";") ``` Remove the first *; and it should work. I ran into the same problem and fixed it this way
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#87914