I have searched for any existing and/or related issues.
I have searched for any existing and/or related discussions.
I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
I am using the latest version of Open WebUI.
Installation Method
Other
Open WebUI Version
0.9.2
Ollama Version (if applicable)
No response
Operating System
k8s
Browser (if applicable)
No response
Confirmation
I have read and followed all instructions in README.md.
I am using the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided every relevant configuration, setting, and environment variable used in my setup.
I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
Start with the initial platform/version/OS and dependencies used,
Specify exact install/launch/configure commands,
List URLs visited, user input (incl. example values/emails/passwords if needed),
Describe all options and toggles enabled or changed,
Include any files or environmental changes,
Identify the expected and actual result at each stage,
Ensure any reasonably skilled user can follow and hit the same issue.
Expected Behavior
Setting the Feishu OAuth env variables exactly as documented at env-configuration#feishu — i.e. FEISHU_CLIENT_ID, FEISHU_CLIENT_SECRET, FEISHU_CLIENT_SCOPE, FEISHU_CLIENT_REDIRECT_URI — should produce a working Feishu login flow, with the redirect_uri parameter sent to accounts.feishu.cn
matching the configured value.
Actual Behavior
The code reads two of those variables under different names than the docs use:
Because users following the docs set FEISHU_CLIENT_REDIRECT_URI, the value the code looks for (FEISHU_REDIRECT_URI) is empty. The Feishu provider is registered with redirect_uri='', and authlib falls back to request.url_for(...) (utils/oauth.py
L1434).
When the reverse proxy in front of Open WebUI terminates TLS but does not forward X-Forwarded-Proto: https (e.g. Aliyun ALB with the default XForwardedForProtoEnabled: false listener
config), request.url_for() produces an http://... URL. Feishu then rejects the callback as a redirect_uri mismatch. The failure is silent from Open WebUI's side — no warning at
startup, no log entry pointing at the env var name.
Deploy Open WebUI v0.9.0 or later behind a reverse proxy that terminates TLS but does not forward X-Forwarded-Proto: https (e.g. Aliyun ALB with default listener config).
Configure Feishu OAuth exactly per the docs, including:
Visit https://<your-host>/oauth/feishu/login and inspect the 302 response.
Observed: the Location header contains redirect_uri=http%3A%2F%2F<your-host>%2Foauth%2Ffeishu%2Fcallback (note http, not https), and Feishu rejects the callback.
Workaround: rename the env var to FEISHU_REDIRECT_URI (and FEISHU_OAUTH_SCOPE if used) to match what the code actually reads. The redirect_uri then comes from the explicit value
and is unaffected by what the proxy forwards.
Logs & Screenshots
N/A
Additional Information
Option A — fix the docs (smallest change): rename FEISHU_CLIENT_REDIRECT_URI → FEISHU_REDIRECT_URI and FEISHU_CLIENT_SCOPE → FEISHU_OAUTH_SCOPE on the env-configuration page.
One PR to open-webui/docs.
Option B — fix the code (better consistency with sibling providers, but a behavior change): rename the env keys in config.py to FEISHU_CLIENT_REDIRECT_URI / FEISHU_CLIENT_SCOPE
while keeping the old names as a fallback for one or two releases so existing deployments don't break:
Independent of A/B, it would help users a lot if FEISHU_CLIENT_ID being set while the redirect URI env var is empty produced a startup warning, so the silent fallback to http:// URLs
doesn't go unnoticed.
Happy to send a PR for whichever direction you prefer.
Originally created by @tuzkiyoung on GitHub (Apr 24, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/24094
### Check Existing Issues
- [x] I have searched for any existing and/or related issues.
- [x] I have searched for any existing and/or related discussions.
- [x] I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
- [x] I am using the latest version of Open WebUI.
### Installation Method
Other
### Open WebUI Version
0.9.2
### Ollama Version (if applicable)
_No response_
### Operating System
k8s
### Browser (if applicable)
_No response_
### Confirmation
- [x] I have read and followed all instructions in `README.md`.
- [x] I am using the latest version of **both** Open WebUI and Ollama.
- [x] I have included the browser console logs.
- [x] I have included the Docker container logs.
- [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.**
- [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
- [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps:
- Start with the initial platform/version/OS and dependencies used,
- Specify exact install/launch/configure commands,
- List URLs visited, user input (incl. example values/emails/passwords if needed),
- Describe all options and toggles enabled or changed,
- Include any files or environmental changes,
- Identify the expected and actual result at each stage,
- Ensure any reasonably skilled user can follow and hit the same issue.
### Expected Behavior
Setting the Feishu OAuth env variables exactly as documented at [env-configuration#feishu](https://docs.openwebui.com/reference/env-configuration/#feishu) — i.e. `FEISHU_CLIENT_ID`,
`FEISHU_CLIENT_SECRET`, `FEISHU_CLIENT_SCOPE`, `FEISHU_CLIENT_REDIRECT_URI` — should produce a working Feishu login flow, with the `redirect_uri` parameter sent to `accounts.feishu.cn`
matching the configured value.
### Actual Behavior
The code reads two of those variables under different names than the docs use:
| Documented (env-configuration#feishu) | Actually read by code |
|---|---|
| `FEISHU_CLIENT_REDIRECT_URI` | **`FEISHU_REDIRECT_URI`** |
| `FEISHU_CLIENT_SCOPE` | **`FEISHU_OAUTH_SCOPE`** |
| `FEISHU_CLIENT_ID` | `FEISHU_CLIENT_ID` ✅ |
| `FEISHU_CLIENT_SECRET` | `FEISHU_CLIENT_SECRET` ✅ |
Code refs (v0.9.2, also present on `main`):
- https://github.com/open-webui/open-webui/blob/v0.9.2/backend/open_webui/config.py#L626-L635
- https://github.com/open-webui/open-webui/blob/v0.9.2/backend/open_webui/config.py#L866-L869
Because users following the docs set `FEISHU_CLIENT_REDIRECT_URI`, the value the code looks for (`FEISHU_REDIRECT_URI`) is empty. The Feishu provider is registered with
`redirect_uri=''`, and authlib falls back to `request.url_for(...)` ([utils/oauth.py
L1434](https://github.com/open-webui/open-webui/blob/v0.9.2/backend/open_webui/utils/oauth.py#L1434)).
When the reverse proxy in front of Open WebUI terminates TLS but does not forward `X-Forwarded-Proto: https` (e.g. Aliyun ALB with the default `XForwardedForProtoEnabled: false` listener
config), `request.url_for()` produces an `http://...` URL. Feishu then rejects the callback as a `redirect_uri` mismatch. The failure is silent from Open WebUI's side — no warning at
startup, no log entry pointing at the env var name.
The mismatch dates back to docs PR https://github.com/open-webui/docs/pull/685, which named the variables to follow the `*_CLIENT_*` pattern used by Google/Microsoft/GitHub providers,
while the code under `config.py` had shipped with the shorter `FEISHU_REDIRECT_URI` / `FEISHU_OAUTH_SCOPE` names. The related fix in PRs
https://github.com/open-webui/open-webui/pull/23129 / https://github.com/open-webui/open-webui/pull/23203 (resolving https://github.com/open-webui/open-webui/issues/23128) only takes
effect when the env var name matches what the code reads — which the docs currently get wrong.
### Steps to Reproduce
1. Deploy Open WebUI v0.9.0 or later behind a reverse proxy that terminates TLS but does **not** forward `X-Forwarded-Proto: https` (e.g. Aliyun ALB with default listener config).
2. Configure Feishu OAuth exactly per the docs, including:
```
FEISHU_CLIENT_ID=<your client id>
FEISHU_CLIENT_SECRET=<your client secret>
FEISHU_CLIENT_REDIRECT_URI=https://<your-host>/oauth/feishu/callback
```
3. Visit `https://<your-host>/oauth/feishu/login` and inspect the 302 response.
Observed: the `Location` header contains `redirect_uri=http%3A%2F%2F<your-host>%2Foauth%2Ffeishu%2Fcallback` (note `http`, not `https`), and Feishu rejects the callback.
Workaround: rename the env var to `FEISHU_REDIRECT_URI` (and `FEISHU_OAUTH_SCOPE` if used) to match what the code actually reads. The `redirect_uri` then comes from the explicit value
and is unaffected by what the proxy forwards.
### Logs & Screenshots
N/A
### Additional Information
**Option A — fix the docs** (smallest change): rename `FEISHU_CLIENT_REDIRECT_URI` → `FEISHU_REDIRECT_URI` and `FEISHU_CLIENT_SCOPE` → `FEISHU_OAUTH_SCOPE` on the env-configuration page.
One PR to [open-webui/docs](https://github.com/open-webui/docs).
**Option B — fix the code** (better consistency with sibling providers, but a behavior change): rename the env keys in `config.py` to `FEISHU_CLIENT_REDIRECT_URI` / `FEISHU_CLIENT_SCOPE`
while keeping the old names as a fallback for one or two releases so existing deployments don't break:
```python
FEISHU_REDIRECT_URI = PersistentConfig(
'FEISHU_CLIENT_REDIRECT_URI',
'oauth.feishu.redirect_uri',
os.environ.get('FEISHU_CLIENT_REDIRECT_URI',
os.environ.get('FEISHU_REDIRECT_URI', '')),
)
```
Independent of A/B, it would help users a lot if `FEISHU_CLIENT_ID` being set while the redirect URI env var is empty produced a startup warning, so the silent fallback to `http://` URLs
doesn't go unnoticed.
Happy to send a PR for whichever direction you prefer.
GiteaMirror
added the bug label 2026-05-15 16:12:27 -05:00
Hi! I'm a first-time contributor and would love to work on this.
I'd like to go with Option A — fixing the docs to match what
the code actually reads (renaming FEISHU_CLIENT_REDIRECT_URI
→ FEISHU_REDIRECT_URI and FEISHU_CLIENT_SCOPE → FEISHU_OAUTH_SCOPE).
Could a maintainer confirm this is the preferred approach
before I open a PR? Thank you!
<!-- gh-comment-id:4325017414 -->
@Ansh1372 commented on GitHub (Apr 27, 2026):
Hi! I'm a first-time contributor and would love to work on this.
I'd like to go with Option A — fixing the docs to match what
the code actually reads (renaming FEISHU_CLIENT_REDIRECT_URI
→ FEISHU_REDIRECT_URI and FEISHU_CLIENT_SCOPE → FEISHU_OAUTH_SCOPE).
Could a maintainer confirm this is the preferred approach
before I open a PR? Thank you!
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @tuzkiyoung on GitHub (Apr 24, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/24094
Check Existing Issues
Installation Method
Other
Open WebUI Version
0.9.2
Ollama Version (if applicable)
No response
Operating System
k8s
Browser (if applicable)
No response
Confirmation
README.md.Expected Behavior
Setting the Feishu OAuth env variables exactly as documented at env-configuration#feishu — i.e.
FEISHU_CLIENT_ID,FEISHU_CLIENT_SECRET,FEISHU_CLIENT_SCOPE,FEISHU_CLIENT_REDIRECT_URI— should produce a working Feishu login flow, with theredirect_uriparameter sent toaccounts.feishu.cnmatching the configured value.
Actual Behavior
The code reads two of those variables under different names than the docs use:
FEISHU_CLIENT_REDIRECT_URIFEISHU_REDIRECT_URIFEISHU_CLIENT_SCOPEFEISHU_OAUTH_SCOPEFEISHU_CLIENT_IDFEISHU_CLIENT_ID✅FEISHU_CLIENT_SECRETFEISHU_CLIENT_SECRET✅Code refs (v0.9.2, also present on
main):Because users following the docs set
FEISHU_CLIENT_REDIRECT_URI, the value the code looks for (FEISHU_REDIRECT_URI) is empty. The Feishu provider is registered withredirect_uri='', and authlib falls back torequest.url_for(...)(utils/oauth.pyL1434).
When the reverse proxy in front of Open WebUI terminates TLS but does not forward
X-Forwarded-Proto: https(e.g. Aliyun ALB with the defaultXForwardedForProtoEnabled: falselistenerconfig),
request.url_for()produces anhttp://...URL. Feishu then rejects the callback as aredirect_urimismatch. The failure is silent from Open WebUI's side — no warning atstartup, no log entry pointing at the env var name.
The mismatch dates back to docs PR https://github.com/open-webui/docs/pull/685, which named the variables to follow the
*_CLIENT_*pattern used by Google/Microsoft/GitHub providers,while the code under
config.pyhad shipped with the shorterFEISHU_REDIRECT_URI/FEISHU_OAUTH_SCOPEnames. The related fix in PRshttps://github.com/open-webui/open-webui/pull/23129 / https://github.com/open-webui/open-webui/pull/23203 (resolving https://github.com/open-webui/open-webui/issues/23128) only takes
effect when the env var name matches what the code reads — which the docs currently get wrong.
Steps to Reproduce
X-Forwarded-Proto: https(e.g. Aliyun ALB with default listener config).https://<your-host>/oauth/feishu/loginand inspect the 302 response.Observed: the
Locationheader containsredirect_uri=http%3A%2F%2F<your-host>%2Foauth%2Ffeishu%2Fcallback(notehttp, nothttps), and Feishu rejects the callback.Workaround: rename the env var to
FEISHU_REDIRECT_URI(andFEISHU_OAUTH_SCOPEif used) to match what the code actually reads. Theredirect_urithen comes from the explicit valueand is unaffected by what the proxy forwards.
Logs & Screenshots
N/A
Additional Information
Option A — fix the docs (smallest change): rename
FEISHU_CLIENT_REDIRECT_URI→FEISHU_REDIRECT_URIandFEISHU_CLIENT_SCOPE→FEISHU_OAUTH_SCOPEon the env-configuration page.One PR to open-webui/docs.
Option B — fix the code (better consistency with sibling providers, but a behavior change): rename the env keys in
config.pytoFEISHU_CLIENT_REDIRECT_URI/FEISHU_CLIENT_SCOPEwhile keeping the old names as a fallback for one or two releases so existing deployments don't break:
Independent of A/B, it would help users a lot if
FEISHU_CLIENT_IDbeing set while the redirect URI env var is empty produced a startup warning, so the silent fallback tohttp://URLsdoesn't go unnoticed.
Happy to send a PR for whichever direction you prefer.
@Ansh1372 commented on GitHub (Apr 27, 2026):
Hi! I'm a first-time contributor and would love to work on this.
I'd like to go with Option A — fixing the docs to match what
the code actually reads (renaming FEISHU_CLIENT_REDIRECT_URI
→ FEISHU_REDIRECT_URI and FEISHU_CLIENT_SCOPE → FEISHU_OAUTH_SCOPE).
Could a maintainer confirm this is the preferred approach
before I open a PR? Thank you!