From 4a4f2bb8e8c97e725155b5b9d71700caff461fa4 Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Sat, 5 Sep 2026 13:02:42 +0200 Subject: [PATCH] fix: disconnect live socket sessions when tokens are revoked Token revocation only took effect at the Socket.IO handshake, so connections established beforehand kept running. Both revocation helpers now drop the user's live sessions after writing the revocation marker, which covers signout, password change, admin user update and OIDC back-channel logout in one place. Clients holding a still-valid token reconnect immediately. --- backend/open_webui/utils/auth.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/backend/open_webui/utils/auth.py b/backend/open_webui/utils/auth.py index 408b518c13..cd0eaf9afe 100644 --- a/backend/open_webui/utils/auth.py +++ b/backend/open_webui/utils/auth.py @@ -303,6 +303,12 @@ async def invalidate_token(request, token): ex=ttl, ) + user_id = decoded.get('id') + if user_id: + from open_webui.socket.main import disconnect_user_sessions + + await disconnect_user_sessions(user_id) + async def revoke_user_tokens(request, user_id: str): """Reject every token already issued to a user. Requires Redis.""" @@ -324,6 +330,10 @@ async def revoke_user_tokens(request, user_id: str): ex=int(expires_delta.total_seconds()) if expires_delta else None, ) + from open_webui.socket.main import disconnect_user_sessions + + await disconnect_user_sessions(user_id) + def extract_token_from_auth_header(auth_header: str): return auth_header[len('Bearer ') :]