Classic298andGitHub 21f770fb73 fix: OAuth 2.1 (Static) MCP connections send no client secret to servers like X Ads (#32818) ...

With OAuth 2.1 (Static), when the authorization server did not accept the client secret as a form field, Open WebUI used whichever auth method the server's metadata listed first. X Ads lists "none" (public client, no secret) first, so the token exchange went out without the configured client secret and X rejected it with "Missing valid authorization header". When the server supports HTTP Basic auth, the secret is now sent that way, no matter which method it lists first.

Fixes #32813

2026-10-21 16:38:34 +09:00

..

data

…

open_webui

fix: OAuth 2.1 (Static) MCP connections send no client secret to servers like X Ads (#32818)

2026-10-21 16:38:34 +09:00

.dockerignore

…

.gitignore

…

dev.sh

perf: allow disabling websocket per-message-deflate (#28613)

2026-08-24 18:46:07 -04:00

requirements-slim.txt

refac

2026-10-05 12:03:19 +04:00

requirements.txt

feat: tag Valkey vector store connections as Open WebUI (#32428)

2026-10-15 00:00:08 +04:00

start_windows.bat

chore: drop nltk, unused at the pinned versions (#29725)

2026-09-06 16:39:05 -04:00

start.sh

refac

2026-09-06 16:48:30 -04:00