scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-20 05:04:09 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge eee2922c90 into b6db719758

Browse source
This commit is contained in:
Micheal Angelo 2026-04-12 00:11:00 +03:00 • committed by GitHub
commit d07bd2e548
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 14 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
.env.example
View file

@ -19,4 +19,7 @@ FORWARDED_ALLOW_IPS='*'
# DO NOT TRACK
SCARF_NO_ANALYTICS=true
DO_NOT_TRACK=true
ANONYMIZED_TELEMETRY=false
ANONYMIZED_TELEMETRY=false
# Enable auditing of GET requests
AUDIT_LOG_GET_REQUESTS=false

12
backend/open_webui/utils/audit.py
View file

@ -28,6 +28,10 @@ from open_webui.env import AUDIT_LOG_LEVEL, AUDIT_INCLUDED_PATHS, MAX_BODY_LOG_S
from open_webui.utils.auth import get_current_user, get_http_authorization_cred
from open_webui.models.users import UserModel
# Toggle to enable auditing of GET requests (default: disabled)
import os
AUDIT_LOG_GET_REQUESTS = os.getenv("AUDIT_LOG_GET_REQUESTS", "false").lower() == "true"
if TYPE_CHECKING:
from loguru import Logger
@ -202,8 +206,6 @@ class AuditLoggingMiddleware:
return None
def _should_skip_auditing(self, request: Request) -> bool:
if request.method not in {'POST', 'PUT', 'PATCH', 'DELETE'} or AUDIT_LOG_LEVEL == 'NONE':
return True
ALWAYS_LOG_ENDPOINTS = {
'/api/v1/auths/signin',
@ -214,6 +216,12 @@ class AuditLoggingMiddleware:
for endpoint in ALWAYS_LOG_ENDPOINTS:
if path.startswith(endpoint):
return False # Do NOT skip logging for auth endpoints
# Handle GET based on env flag
if request.method == 'GET' and not AUDIT_LOG_GET_REQUESTS:
return True
if request.method not in {'GET', 'POST', 'PUT', 'PATCH', 'DELETE'} or AUDIT_LOG_LEVEL == 'NONE':
return True
# Skip logging if the request is not authenticated
# Check both Authorization header (API keys) and token cookie (browser sessions)