fix: MCP OAuth sign-in fails when the provider's sign-in page is behind Cloudflare bot protection

Connecting an OAuth 2.1 MCP tool server such as Canva failed with "OAuth client registration is still invalid after re-registration" whenever Cloudflare answered Open WebUI's own server-side check of the provider's sign-in page with a bot challenge. The challenge page repeats the requested address, which contains the redirect URL, so Open WebUI read it as the provider rejecting its registration. Open WebUI now skips its check when it gets a bot challenge, and the browser goes on to the provider's sign-in page as usual. Real provider errors about an unknown client or redirect URL still trigger re-registration as before.

Fixes #32363

backend/open_webui/utils/oauth.py

@@ -1008,6 +1008,12 @@ class OAuthClientManager:
                 ) as resp:
                     if resp.status < 400:
                         return True
+
+                    # Bot challenge pages echo the request URL, so their keywords say nothing about the client
+                    if resp.headers.get('cf-mitigated'):
+                        log.debug('Skipping OAuth preflight for client %s: bot challenge', client_info.client_id)
+                        return True
+
                     response_text = await resp.text()
 
                     error = None