scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-11-07 08:17:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix: normalize OAuth server metadata URLs

Browse source
This commit is contained in:
TheEdgeOfRage 2026-07-28 01:41:02 +02:00
parent 810378c0b8
commit 599f3a0e9c
No known key found for this signature in database
GPG key ID: 66AD4BA646FBC0D2
3 changed files with 23 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
backend/open_webui/routers/configs.py
View file

@ -15,6 +15,7 @@ from open_webui.models.oauth_sessions import OAuthSessions
from open_webui.utils.auth import get_admin_user, get_verified_user
from open_webui.utils.headers import get_custom_headers
from open_webui.utils.mcp.client import MCPClient
from open_webui.utils.oauth_metadata import normalize_oauth_metadata
from open_webui.utils.oauth import (
OAuthClientInformationFull,
apply_connection_oauth_options,
@ -568,7 +569,9 @@ async def verify_tool_servers_config(request: Request, form_data: ToolServerConn
if oauth_server_metadata_response.status == 200:
try:
oauth_server_metadata = OAuthMetadata.model_validate(
await oauth_server_metadata_response.json()
normalize_oauth_metadata(
await oauth_server_metadata_response.json(), discovery_url
)
)
return {
'status': True,

7
backend/open_webui/utils/oauth.py
View file

@ -88,6 +88,7 @@ from open_webui.retrieval.web.utils import get_ssrf_safe_session, validate_url
from open_webui.utils.auth import create_token, get_password_hash
from open_webui.utils.groups import apply_default_group_assignment
from open_webui.utils.misc import parse_duration
from open_webui.utils.oauth_metadata import normalize_oauth_metadata
from open_webui.utils.validate import validate_profile_image_url
from starlette.responses import RedirectResponse
@ -535,7 +536,7 @@ async def get_oauth_client_info_with_dynamic_client_registration(
if oauth_server_metadata_response.status == 200:
try:
oauth_server_metadata = OAuthMetadata.model_validate(
await oauth_server_metadata_response.json()
normalize_oauth_metadata(await oauth_server_metadata_response.json(), url)
)
oauth_server_metadata_url = url
if (
@ -663,7 +664,9 @@ async def get_oauth_client_info_with_static_credentials(
async with session.get(url, ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp:
if resp.status == 200:
try:
oauth_server_metadata = OAuthMetadata.model_validate(await resp.json())
oauth_server_metadata = OAuthMetadata.model_validate(
normalize_oauth_metadata(await resp.json(), url)
)
oauth_server_metadata_url = url
break
except Exception as e:

14
backend/open_webui/utils/oauth_metadata.py Normal file
View file

@ -0,0 +1,14 @@
import urllib.parse
def normalize_oauth_metadata(metadata: dict, metadata_url: str) -> dict:
normalized = dict(metadata)
parsed_url = urllib.parse.urlparse(metadata_url)
origin = f'{parsed_url.scheme}://{parsed_url.netloc}'
normalized.setdefault('issuer', origin)
for field, value in normalized.items():
if isinstance(value, str) and (field == 'issuer' or field.endswith('_endpoint') or field == 'jwks_uri'):
normalized[field] = urllib.parse.urljoin(f'{origin}/', value)
return normalized