scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-08 03:08:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

refactor: remove the dead signature check, the token header helper and an unused environment variable

Browse source 
The backend carries an HMAC signature verifier that nothing calls. It could not have worked in any case: it feeds the key straight from the environment into the HMAC constructor as text where bytes are required, so every call raised, got swallowed by the surrounding catch-all and returned false for correct and incorrect signatures alike. It failed closed, so there was never a window where a bad signature was accepted. A helper that pulls a token out of an authorization header sits in the same module with no caller since token checks moved to dependencies.

Removing the verifier leaves TRUSTED_SIGNATURE_KEY with no reader, so it goes too. The variable is not referenced in the documentation and setting it never had an effect, so no deployment changes.
This commit is contained in:
Classic298 2026-08-20 22:06:35 +02:00
parent 8a42aa53e8
commit e3900d5ca7
2 changed files with 0 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
backend/open_webui/env.py
View file

@ -914,7 +914,6 @@ if WEBUI_NAME != 'Open WebUI':
# https://docs.openwebui.com/license.
WEBUI_FAVICON_URL = 'https://openwebui.com/favicon.png'
WEBUI_BUILD_HASH = os.getenv('WEBUI_BUILD_HASH', 'dev-build')
TRUSTED_SIGNATURE_KEY = os.getenv('TRUSTED_SIGNATURE_KEY', '')
####################################
# Feature flags

22
backend/open_webui/utils/auth.py
View file

@ -3,7 +3,6 @@ from __future__ import annotations
import asyncio
import base64
import hashlib
import hmac
import logging
import os
import uuid
@ -30,7 +29,6 @@ from open_webui.env import (
PASSWORD_VALIDATION_REGEX_PATTERN,
REDIS_KEY_PREFIX,
STATIC_DIR,
TRUSTED_SIGNATURE_KEY,
WEBUI_AUTH_TRUSTED_EMAIL_HEADER,
WEBUI_SECRET_KEY,
pk,
@ -54,22 +52,6 @@ PASSWORD_BCRYPT_MAX_BYTES = 72
##############
def verify_signature(payload: str, signature: str) -> bool:
"""
Verifies the HMAC signature of the received payload.
"""
try:
expected_signature = base64.b64encode(
hmac.new(TRUSTED_SIGNATURE_KEY, payload.encode(), hashlib.sha256).digest()
).decode()
# Compare securely to prevent timing attacks
return hmac.compare_digest(expected_signature, signature)
except Exception:
return False
def override_static(path: str, content: str):
# Ensure path is safe
if '/' in path or '..' in path:
@ -325,10 +307,6 @@ async def revoke_user_tokens(request, user_id: str):
)
def extract_token_from_auth_header(auth_header: str):
return auth_header[len('Bearer ') :]
def create_api_key():
key = str(uuid.uuid4()).replace('-', '')
return f'sk-{key}'