github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-07-23 03:23:08 -05:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

[GH-ISSUE #14917] issue: Case Sensitivity Issue in Trusted Header Authentication #88143

New Issue
Closed
opened 2026-05-15 12:36:50 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-05-15 12:36:50 -05:00
Owner
Copy Link
Copy Source

Originally created by @ediiiz on GitHub (Jun 12, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/14917

Check Existing Issues

  • I have searched the existing issues and discussions.
  • I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

v0.6.14

Ollama Version (if applicable)

No response

Operating System

Debian 12

Browser (if applicable)

No response

Confirmation

  • I have read and followed all instructions in README.md.
  • I am using the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have provided every relevant configuration, setting, and environment variable used in my setup.
  • I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
  • I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
  • Start with the initial platform/version/OS and dependencies used,
  • Specify exact install/launch/configure commands,
  • List URLs visited, user input (incl. example values/emails/passwords if needed),
  • Describe all options and toggles enabled or changed,
  • Include any files or environmental changes,
  • Identify the expected and actual result at each stage,
  • Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

With trusted header authentication via Traefik/Authentik:

Authentication headers should be properly recognized regardless of email case
Login should complete successfully
All subsequent authenticated API calls should succeed
UI should function normally with access to chats, settings, and models

Actual Behavior

Initial login appears successful (200 response for signin)
All subsequent API requests to protected endpoints fail with 401 errors and message: "User mismatch. Please sign in again."
UI is partially broken due to failed API requests
Identical configuration works perfectly with v0.6.13

Steps to Reproduce

  1. Environment Setup:

    • Traefik v3.3 with Authentik authentication
    • Authentik default property mappings

  2. docker-compose.yml Configuration:

services:
  open-webui:
    image: ghcr.io/open-webui/open-webui:main # v0.6.14
    environment:
      - WEBUI_AUTH_TRUSTED_EMAIL_HEADER=X-authentik-email
      - WEBUI_AUTH_TRUSTED_NAME_HEADER=X-authentik-name
      - WEBUI_AUTH_TRUSTED_GROUPS_HEADER=x-user-context
      - ENABLE_FORWARD_USER_INFO_HEADERS=True
      - REDIS_URL=redis://redis:6379/0
    # ... (other settings as shown in user's config)

  1. Authentik Configuration:

    • Ensure email headers are passed with original case
    • Example user email: John.Doe@Example.com

  2. Access Workflow:

    • Access Open WebUI through Traefik/Authentik proxy
    • Complete Authentik authentication
    • Observe successful POST to /api/v1/auths/signin (200)
    • Observe subsequent GET requests failing with 401 and "User mismatch" error

  3. Validation:

    • Revert to v0.6.13: image: ghcr.io/open-webui/open-webui:0.6.13
    • Observe all endpoints work normally with identical configuration

Logs & Screenshots

open-webui-1 | 2025-06-12 05:44:58.078 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/v1/auths/ HTTP/1.1" 401 - {}
open-webui-1 | 2025-06-12 05:44:58.229 | INFO | open_webui.models.auths:authenticate_user_by_email:163 - authenticate_user_by_email: ediz.tefenlilioglu@dyckerhoff.com - {}
open-webui-1 | 2025-06-12 05:44:58.237 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "POST /api/v1/auths/signin HTTP/1.1" 200 - {}
open-webui-1 | 2025-06-12 05:44:58.238 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /static/favicon-dark.png HTTP/1.1" 200 - {}
open-webui-1 | 2025-06-12 05:44:58.335 | DEBUG | open_webui.socket.main:user_join:221 - channels=[] - {}
open-webui-1 | 2025-06-12 05:44:58.354 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/config HTTP/1.1" 200 - {}
open-webui-1 | 2025-06-12 05:44:58.412 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/v1/chats/archived?page=1&order_by=updated_at&direction=desc HTTP/1.1" 401 - {}
open-webui-1 | 2025-06-12 05:44:58.447 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/v1/chats/?page=1 HTTP/1.1" 401 - {}
open-webui-1 | 2025-06-12 05:44:58.447 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/changelog HTTP/1.1" 200 - {}
open-webui-1 | 2025-06-12 05:44:58.449 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/v1/channels/ HTTP/1.1" 401 - {}
open-webui-1 | 2025-06-12 05:44:58.536 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/v1/users/user/settings HTTP/1.1" 401 - {}
open-webui-1 | 2025-06-12 05:44:58.556 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/models HTTP/1.1" 401 - {}

Additional Information

Root Cause

The issue is caused by inconsistent case handling between Authentik headers and Open WebUI's email processing:

  1. Authentik Behavior:

    • Returns email headers with original case (e.g., John.Doe@Example.com)
    • Preserves case from identity provider or user input

  2. Open WebUI Behavior:

    • During signup (auths.py), emails are normalized to lowercase: 
      email = request.headers[WEBUI_AUTH_TRUSTED_EMAIL_HEADER].lower()
    • All emails are stored in lowercase format in the database
    • The new security check in v0.6.14 performs case-sensitive comparison: 
      if trusted_email and user.email != trusted_email:  # Case-sensitive

  3. Result:

    • Authentik: John.Doe@Example.com
    • Open WebUI: john.doe@example.com
    • Comparison fails → "User mismatch" error

Workarounds:

  1. Short-term:

    # Force lowercase in Authentik property mappings for email
# authentik default OAuth Mapping: OpenID 'email'
return {
 "email": request.user.email.lower(),
 "email_verified": True
}
# authentik default SAML Mapping: Email:
return request.user.email.lower()

  2. Temporary:

    # Revert to v0.6.13
image: ghcr.io/open-webui/open-webui:v0.6.13
Originally created by @ediiiz on GitHub (Jun 12, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/14917 ### Check Existing Issues - [x] I have searched the existing issues and discussions. - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version v0.6.14 ### Ollama Version (if applicable) _No response_ ### Operating System Debian 12 ### Browser (if applicable) _No response_ ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior With trusted header authentication via Traefik/Authentik: Authentication headers should be properly recognized regardless of email case Login should complete successfully All subsequent authenticated API calls should succeed UI should function normally with access to chats, settings, and models ### Actual Behavior Initial login appears successful (200 response for signin) All subsequent API requests to protected endpoints fail with 401 errors and message: "User mismatch. Please sign in again." UI is partially broken due to failed API requests Identical configuration works perfectly with v0.6.13 ### Steps to Reproduce 1. **Environment Setup**: - Traefik v3.3 with Authentik authentication - Authentik default property mappings 2. **docker-compose.yml Configuration**: ```yaml services: open-webui: image: ghcr.io/open-webui/open-webui:main # v0.6.14 environment: - WEBUI_AUTH_TRUSTED_EMAIL_HEADER=X-authentik-email - WEBUI_AUTH_TRUSTED_NAME_HEADER=X-authentik-name - WEBUI_AUTH_TRUSTED_GROUPS_HEADER=x-user-context - ENABLE_FORWARD_USER_INFO_HEADERS=True - REDIS_URL=redis://redis:6379/0 # ... (other settings as shown in user's config) ``` 3. **Authentik Configuration**: - Ensure email headers are passed with original case - Example user email: `John.Doe@Example.com` 4. **Access Workflow**: - Access Open WebUI through Traefik/Authentik proxy - Complete Authentik authentication - Observe successful POST to `/api/v1/auths/signin` (200) - Observe subsequent GET requests failing with 401 and "User mismatch" error 5. **Validation**: - Revert to v0.6.13: `image: ghcr.io/open-webui/open-webui:0.6.13` - Observe all endpoints work normally with identical configuration ### Logs & Screenshots open-webui-1 | 2025-06-12 05:44:58.078 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/v1/auths/ HTTP/1.1" 401 - {} open-webui-1 | 2025-06-12 05:44:58.229 | INFO | open_webui.models.auths:authenticate_user_by_email:163 - authenticate_user_by_email: [ediz.tefenlilioglu@dyckerhoff.com ](mailto:ediz.tefenlilioglu@dyckerhoff.com)- {} open-webui-1 | 2025-06-12 05:44:58.237 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "POST /api/v1/auths/signin HTTP/1.1" 200 - {} open-webui-1 | 2025-06-12 05:44:58.238 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /static/favicon-dark.png HTTP/1.1" 200 - {} open-webui-1 | 2025-06-12 05:44:58.335 | DEBUG | open_webui.socket.main:user_join:221 - channels=[] - {} open-webui-1 | 2025-06-12 05:44:58.354 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/config HTTP/1.1" 200 - {} open-webui-1 | 2025-06-12 05:44:58.412 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/v1/chats/archived?page=1&order_by=updated_at&direction=desc HTTP/1.1" 401 - {} open-webui-1 | 2025-06-12 05:44:58.447 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/v1/chats/?page=1 HTTP/1.1" 401 - {} open-webui-1 | 2025-06-12 05:44:58.447 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/changelog HTTP/1.1" 200 - {} open-webui-1 | 2025-06-12 05:44:58.449 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/v1/channels/ HTTP/1.1" 401 - {} open-webui-1 | 2025-06-12 05:44:58.536 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/v1/users/user/settings HTTP/1.1" 401 - {} open-webui-1 | 2025-06-12 05:44:58.556 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 10.32.65.85:0 - "GET /api/models HTTP/1.1" 401 - {} ### Additional Information ### Root Cause The issue is caused by inconsistent case handling between Authentik headers and Open WebUI's email processing: 1. **Authentik Behavior**: - Returns email headers with original case (e.g., `John.Doe@Example.com`) - Preserves case from identity provider or user input 2. **Open WebUI Behavior**: - During signup (auths.py), emails are normalized to lowercase: ```python email = request.headers[WEBUI_AUTH_TRUSTED_EMAIL_HEADER].lower() ``` - All emails are stored in lowercase format in the database - The new security check in v0.6.14 performs case-sensitive comparison: ```python if trusted_email and user.email != trusted_email: # Case-sensitive ``` 3. **Result**: - Authentik: `John.Doe@Example.com` - Open WebUI: `john.doe@example.com` - Comparison fails → "User mismatch" error --- ### Workarounds: 1. **Short-term**: ```bash # Force lowercase in Authentik property mappings for email # authentik default OAuth Mapping: OpenID 'email' return { "email": request.user.email.lower(), "email_verified": True } # authentik default SAML Mapping: Email: return request.user.email.lower() ``` 2. **Temporary**: ```yaml # Revert to v0.6.13 image: ghcr.io/open-webui/open-webui:v0.6.13 ```
GiteaMirror added the bug label 2026-05-15 12:36:50 -05:00
GiteaMirror commented 2026-05-15 12:36:52 -05:00
Author
Owner
Copy Link
Copy Source

@tjbck commented on GitHub (Jun 12, 2025):

Good catch, addressed in dev!

<!-- gh-comment-id:2965617071 --> @tjbck commented on GitHub (Jun 12, 2025): Good catch, addressed in dev!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#88143