scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-08-28 05:27:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix: remove hardcoded WEBUI_SECRET_KEY fallback, require key explicitly (#25218)

Browse source 
The 't0p-s3cr3t' default was dead code on every supported startup path:
start.sh, start_windows.bat and `open-webui serve` all set or
auto-generate WEBUI_SECRET_KEY before the backend imports env.py. It was
only ever reachable by invoking uvicorn directly, which is unsupported
and unsafe (the app would then sign tokens/cookies with a public,
hardcoded key). It also keeps getting reported as a vulnerability because
it looks dangerous, even though it is unreachable in practice.

Drop the fallback (default to '') so an unset key is caught by the
existing WEBUI_AUTH guard, and replace the vague error with a clear,
actionable message explaining that the key is a hard requirement and how
the supported start methods provide it. Exit cleanly via SystemExit
instead of raising a ValueError traceback.

WEBUI_AUTH=False keeps working unchanged (key defaults to '').

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Classic298 2026-05-31 23:53:25 +02:00 • committed by GitHub
parent 76b0e65818
commit f2650353da
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 10 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
backend/open_webui/env.py
View file

@ -16,8 +16,6 @@ import markdown
from bs4 import BeautifulSoup
from cryptography.hazmat.primitives import serialization
from open_webui.constants import ERROR_MESSAGES
####################################
# Load .env file
####################################
@ -603,9 +601,10 @@ ENABLE_SIGNUP_PASSWORD_CONFIRMATION = os.getenv('ENABLE_SIGNUP_PASSWORD_CONFIRMA
####################################
# WEBUI_JWT_SECRET_KEY is deprecated; use WEBUI_SECRET_KEY instead.
# No hardcoded fallback by design: the supported start scripts set/auto-generate it; unset is rejected below.
WEBUI_SECRET_KEY = os.getenv(
'WEBUI_SECRET_KEY',
os.getenv('WEBUI_JWT_SECRET_KEY', 't0p-s3cr3t'),
os.getenv('WEBUI_JWT_SECRET_KEY', ''),
)
WEBUI_SESSION_COOKIE_SAME_SITE = os.getenv('WEBUI_SESSION_COOKIE_SAME_SITE', 'lax')
@ -620,7 +619,14 @@ WEBUI_AUTH_COOKIE_SECURE = (
)
if WEBUI_AUTH and WEBUI_SECRET_KEY == '':
raise ValueError(ERROR_MESSAGES.ENV_VAR_NOT_FOUND)
raise SystemExit(
'WEBUI_SECRET_KEY is not set. It is a hard requirement when authentication is enabled.\n'
'The supported start methods set or auto-generate it for you: use start.sh (Linux/macOS), '
'start_windows.bat (Windows), or `open-webui serve`.\n'
'If you start the backend another way (e.g. invoking uvicorn directly, which is unsupported), '
'you must set WEBUI_SECRET_KEY yourself to a long random value.\n'
'See https://docs.openwebui.com/reference/env-configuration#webui_secret_key'
)
ENABLE_COMPRESSION_MIDDLEWARE = os.getenv('ENABLE_COMPRESSION_MIDDLEWARE', 'True').lower() == 'true'