[GH-ISSUE #24650] feat: Add Two-Factor Authentication (2FA) with Google Authenticator (TOTP) #91111

New Issue

GiteaMirror · 2026-05-15T16:23:16-05:00

GiteaMirror commented

2026-05-15 16:23:16 -05:00

Originally created by @sharyuke on GitHub (May 13, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/24650

Summary

First of all, thank you for building such an excellent self-hosted AI platform. Open WebUI is incredibly feature-rich and a joy to use. I truly appreciate all the work that goes into this project.

Motivation

While Open WebUI offers robust security features like RBAC, LDAP integration, and SSO via OAuth/OIDC, one critical layer of account protection is currently missing: Two-Factor Authentication (2FA).

Currently, an account is protected solely by a password. In a self-hosted environment exposed to the internet (even behind a reverse proxy), account credentials can be vulnerable to brute-force or credential-stuffing attacks. If a password is compromised or leaked, there is no second layer of defense to prevent unauthorized access.

Proposed Solution

Implement Time-based One-Time Password (TOTP) 2FA, compatible with Google Authenticator and similar authenticator apps (Authy, 1Password, Bitwarden, etc.).

Suggested Implementation Details

Per-user opt-in 2FA: Users can enable 2FA from their profile/settings page
TOTP standard: Use the standard TOTP algorithm (RFC 6238), compatible with Google Authenticator
Setup flow: Display a QR code during 2FA setup that users scan with their authenticator app
Recovery codes: Provide one-time recovery codes when 2FA is first enabled
Admin enforcement option: Allow administrators to mandate 2FA for all users or specific user groups
Backup verification: Graceful fallback handling if 2FA device is temporarily unavailable

Alternatives Considered

SMS-based 2FA: Not recommended due to SIM-swapping vulnerabilities
Hardware keys (WebAuthn/U2F): Excellent security but adds hardware cost and complexity for users
OAuth/SSO delegation: Already supported (Discussion #340), but requires an external identity provider

TOTP strikes the best balance between security and accessibility — users only need a free authenticator app on their phone.

Use Cases

Self-hosted deployments exposed to the public internet
Team environments where multiple users share an instance
Compliance requirements for organizations with security policies mandating 2FA
Anyone who wants an extra layer of protection beyond a strong password

Priority

This would be a significant security improvement for production deployments. Even a basic implementation (per-user opt-in TOTP) would greatly enhance account security without requiring major architectural changes.

Thank you again for this amazing project. I look forward to seeing how it continues to evolve.

Originally created by @sharyuke on GitHub (May 13, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/24650 ## Summary First of all, thank you for building such an excellent self-hosted AI platform. Open WebUI is incredibly feature-rich and a joy to use. I truly appreciate all the work that goes into this project. ## Motivation While Open WebUI offers robust security features like RBAC, LDAP integration, and SSO via OAuth/OIDC, one critical layer of account protection is currently missing: **Two-Factor Authentication (2FA)**. Currently, an account is protected solely by a password. In a self-hosted environment exposed to the internet (even behind a reverse proxy), account credentials can be vulnerable to brute-force or credential-stuffing attacks. If a password is compromised or leaked, there is no second layer of defense to prevent unauthorized access. ## Proposed Solution Implement Time-based One-Time Password (TOTP) 2FA, compatible with Google Authenticator and similar authenticator apps (Authy, 1Password, Bitwarden, etc.). ### Suggested Implementation Details - **Per-user opt-in 2FA**: Users can enable 2FA from their profile/settings page - **TOTP standard**: Use the standard TOTP algorithm (RFC 6238), compatible with Google Authenticator - **Setup flow**: Display a QR code during 2FA setup that users scan with their authenticator app - **Recovery codes**: Provide one-time recovery codes when 2FA is first enabled - **Admin enforcement option**: Allow administrators to mandate 2FA for all users or specific user groups - **Backup verification**: Graceful fallback handling if 2FA device is temporarily unavailable ## Alternatives Considered - **SMS-based 2FA**: Not recommended due to SIM-swapping vulnerabilities - **Hardware keys (WebAuthn/U2F)**: Excellent security but adds hardware cost and complexity for users - **OAuth/SSO delegation**: Already supported (Discussion #340), but requires an external identity provider TOTP strikes the best balance between security and accessibility — users only need a free authenticator app on their phone. ## Use Cases - Self-hosted deployments exposed to the public internet - Team environments where multiple users share an instance - Compliance requirements for organizations with security policies mandating 2FA - Anyone who wants an extra layer of protection beyond a strong password ## Priority This would be a significant security improvement for production deployments. Even a basic implementation (per-user opt-in TOTP) would greatly enhance account security without requiring major architectural changes. --- Thank you again for this amazing project. I look forward to seeing how it continues to evolve.

GiteaMirror commented

2026-05-15 16:23:18 -05:00

@owui-terminator[bot] commented on GitHub (May 13, 2026):

🔍 Related Issues Found

I found some existing issues that might be related. Please check if any of these are duplicates or contain helpful solutions:

🟢 #1225 feat: 2FA/MFA TOTP support
This is essentially the same request: adding TOTP-based 2FA/MFA for Open WebUI accounts, with the same motivation of protecting internet-exposed self-hosted instances. It even mentions the lack of a TOTP setting and asks for authenticator-app support.
by ghost

💡 If your issue is a duplicate, please close it and add any additional details to the existing issue instead.

This comment was generated automatically. React with 👍 if helpful, 👎 if not.

@owui-terminator[bot] commented on GitHub (May 13, 2026):  🔍 **Related Issues Found** I found some existing issues that might be related. Please check if any of these are duplicates or contain helpful solutions: 1. 🟢 [#1225](https://github.com/open-webui/open-webui/issues/1225) **feat: 2FA/MFA TOTP support** *This is essentially the same request: adding TOTP-based 2FA/MFA for Open WebUI accounts, with the same motivation of protecting internet-exposed self-hosted instances. It even mentions the lack of a TOTP setting and asks for authenticator-app support.* *by ghost* --- 💡 If your issue is a duplicate, please close it and add any additional details to the existing issue instead. *This comment was generated automatically.* React with 👍 if helpful, 👎 if not.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#91111