From 4c392c9878b3de52acbe69c0d0fcbd2ae8cc5cea Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Tue, 13 Oct 2026 18:51:14 +0200 Subject: [PATCH] fix: MCP OAuth sign-in fails when the provider's sign-in page is behind Cloudflare bot protection Connecting an OAuth 2.1 MCP tool server such as Canva failed with "OAuth client registration is still invalid after re-registration" whenever Cloudflare answered Open WebUI's own server-side check of the provider's sign-in page with a bot challenge. The challenge page repeats the requested address, which contains the redirect URL, so Open WebUI read it as the provider rejecting its registration. Open WebUI now skips its check when it gets a bot challenge, and the browser goes on to the provider's sign-in page as usual. Real provider errors about an unknown client or redirect URL still trigger re-registration as before. Fixes #32363 --- backend/open_webui/utils/oauth.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/backend/open_webui/utils/oauth.py b/backend/open_webui/utils/oauth.py index 0c7ddc489a..76f1ebb346 100644 --- a/backend/open_webui/utils/oauth.py +++ b/backend/open_webui/utils/oauth.py @@ -1008,6 +1008,12 @@ class OAuthClientManager: ) as resp: if resp.status < 400: return True + + # Bot challenge pages echo the request URL, so their keywords say nothing about the client + if resp.headers.get('cf-mitigated'): + log.debug('Skipping OAuth preflight for client %s: bot challenge', client_info.client_id) + return True + response_text = await resp.text() error = None