From c1615bec2f5f143084b5fcc04f42ebfa0dade9df Mon Sep 17 00:00:00 2001 From: Timothy Jaeryang Baek Date: Sat, 12 Sep 2026 18:57:18 -0400 Subject: [PATCH] refac --- backend/open_webui/utils/auth.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/backend/open_webui/utils/auth.py b/backend/open_webui/utils/auth.py index bfdbbafd05..9a967132de 100644 --- a/backend/open_webui/utils/auth.py +++ b/backend/open_webui/utils/auth.py @@ -42,6 +42,7 @@ from open_webui.utils.access_control import has_permission from open_webui.utils.json_codec import JSONCodec from open_webui.utils.misc import parse_duration from pytz import UTC +from redis.exceptions import RedisError log = logging.getLogger(__name__) @@ -254,8 +255,13 @@ async def is_valid_token(decoded, redis=None) -> bool: 1. Per-token (jti) — used by user-initiated sign-out (known jti). 2. Per-user (revoked_at) — used by password changes and OIDC back-channel logout when individual jti values are unknown; rejects tokens with iat <= revoked_at. + + Fail open on Redis errors to preserve availability; revoked tokens may be accepted. """ - if redis: + if not redis: + return True + + try: # Per-token revocation jti = decoded.get('jti') if jti: @@ -276,6 +282,8 @@ async def is_valid_token(decoded, redis=None) -> bool: return False except (ValueError, TypeError): pass + except RedisError as e: + log.warning('Revocation check failed; accepting token: %s', e) return True