From 209b15b9633c63ce1b7cf3c1fdc6e032d67978c6 Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Wed, 14 Oct 2026 22:01:10 +0200
Subject: [PATCH] feat: keep socket.io long polling out of the audit log
 (#32425)

With websocket support turned off, the browser falls back to HTTP long polling and every poll was written to the audit log as its own entry, flooding it. The same traffic over a websocket was never audited, and AUDIT_EXCLUDED_PATHS only matches API routes, so there was no way to filter it out. Polling requests are now skipped as well, so the audit log looks the same whichever transport is in use.

Fixes #31871
---
 backend/open_webui/utils/audit.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/backend/open_webui/utils/audit.py b/backend/open_webui/utils/audit.py
index 64a3345844..e5ff7564c1 100644
--- a/backend/open_webui/utils/audit.py
+++ b/backend/open_webui/utils/audit.py
@@ -255,6 +255,9 @@ class AuditLoggingMiddleware:
         if request.method not in self.audited_methods:
             return True
 
+        if request.url.path.startswith('/ws/socket.io'):
+            return True
+
         path = request.url.path.lower()
         for endpoint in self.ALWAYS_LOG_ENDPOINTS:
             if path.startswith(endpoint):