scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-27 06:12:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix: OAuth 2.1 (Static) MCP connections send no client secret to servers like X Ads (#32818)

Browse source 
With OAuth 2.1 (Static), when the authorization server did not accept the client secret as a form field, Open WebUI used whichever auth method the server's metadata listed first. X Ads lists "none" (public client, no secret) first, so the token exchange went out without the configured client secret and X rejected it with "Missing valid authorization header". When the server supports HTTP Basic auth, the secret is now sent that way, no matter which method it lists first.

Fixes #32813
This commit is contained in:
Classic298 2026-10-21 09:38:34 +02:00 • committed by GitHub
parent 7909f2bb99
commit 21f770fb73
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
backend/open_webui/utils/oauth.py
View file

@ -714,7 +714,11 @@ async def get_oauth_client_info_with_static_credentials(
oauth_server_metadata.token_endpoint_auth_methods_supported
and token_endpoint_auth_method not in oauth_server_metadata.token_endpoint_auth_methods_supported
):
token_endpoint_auth_method = oauth_server_metadata.token_endpoint_auth_methods_supported[0]
# List order is no preference; prefer a method that sends the secret
if 'client_secret_basic' in oauth_server_metadata.token_endpoint_auth_methods_supported:
token_endpoint_auth_method = 'client_secret_basic'
else:
token_endpoint_auth_method = oauth_server_metadata.token_endpoint_auth_methods_supported[0]
oauth_client_info = OAuthClientInformationFull(
client_id=oauth_client_id,