From 6a85abb3f5e002f3069007213e16e4ef60776890 Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Sat, 12 Sep 2026 19:45:42 -0400
Subject: [PATCH] refac

---
 backend/open_webui/utils/auth.py | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/backend/open_webui/utils/auth.py b/backend/open_webui/utils/auth.py
index 9a967132de..612a56ef92 100644
--- a/backend/open_webui/utils/auth.py
+++ b/backend/open_webui/utils/auth.py
@@ -8,6 +8,8 @@ import logging
 import os
 import uuid
 from datetime import datetime, timedelta
+from threading import Lock
+from time import monotonic
 from typing import Optional, Union
 
 import bcrypt
@@ -249,6 +251,28 @@ def decode_token(token: str) -> dict | None:
         return None
 
 
+class RateLimitFilter(logging.Filter):
+    """Limit a logger to one record per interval per process."""
+
+    def __init__(self, interval=60):
+        super().__init__()
+        self.interval = interval
+        self.next_allowed = float('-inf')
+        self.lock = Lock()
+
+    def filter(self, record):
+        with self.lock:
+            now = monotonic()
+            if now < self.next_allowed:
+                return False
+            self.next_allowed = now + self.interval
+        return True
+
+
+revocation_log = logging.getLogger(f'{__name__}.revocation')
+revocation_log.addFilter(RateLimitFilter())
+
+
 async def is_valid_token(decoded, redis=None) -> bool:
     """
     Check whether a JWT has been revoked. Two mechanisms:
@@ -283,7 +307,7 @@ async def is_valid_token(decoded, redis=None) -> bool:
                 except (ValueError, TypeError):
                     pass
     except RedisError as e:
-        log.warning('Revocation check failed; accepting token: %s', e)
+        revocation_log.warning('Revocation check failed; accepting token: %s', e)
 
     return True