From f2650353da99a561e5f59c5d22df19d1d1e44be6 Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Sun, 31 May 2026 23:53:25 +0200 Subject: [PATCH] fix: remove hardcoded WEBUI_SECRET_KEY fallback, require key explicitly (#25218) The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, start_windows.bat and `open-webui serve` all set or auto-generate WEBUI_SECRET_KEY before the backend imports env.py. It was only ever reachable by invoking uvicorn directly, which is unsupported and unsafe (the app would then sign tokens/cookies with a public, hardcoded key). It also keeps getting reported as a vulnerability because it looks dangerous, even though it is unreachable in practice. Drop the fallback (default to '') so an unset key is caught by the existing WEBUI_AUTH guard, and replace the vague error with a clear, actionable message explaining that the key is a hard requirement and how the supported start methods provide it. Exit cleanly via SystemExit instead of raising a ValueError traceback. WEBUI_AUTH=False keeps working unchanged (key defaults to ''). Co-authored-by: Claude Opus 4.8 (1M context) --- backend/open_webui/env.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/backend/open_webui/env.py b/backend/open_webui/env.py index 1deed8da83..0ea8ca0f7a 100644 --- a/backend/open_webui/env.py +++ b/backend/open_webui/env.py @@ -16,8 +16,6 @@ import markdown from bs4 import BeautifulSoup from cryptography.hazmat.primitives import serialization -from open_webui.constants import ERROR_MESSAGES - #################################### # Load .env file #################################### @@ -603,9 +601,10 @@ ENABLE_SIGNUP_PASSWORD_CONFIRMATION = os.getenv('ENABLE_SIGNUP_PASSWORD_CONFIRMA #################################### # WEBUI_JWT_SECRET_KEY is deprecated; use WEBUI_SECRET_KEY instead. +# No hardcoded fallback by design: the supported start scripts set/auto-generate it; unset is rejected below. WEBUI_SECRET_KEY = os.getenv( 'WEBUI_SECRET_KEY', - os.getenv('WEBUI_JWT_SECRET_KEY', 't0p-s3cr3t'), + os.getenv('WEBUI_JWT_SECRET_KEY', ''), ) WEBUI_SESSION_COOKIE_SAME_SITE = os.getenv('WEBUI_SESSION_COOKIE_SAME_SITE', 'lax') @@ -620,7 +619,14 @@ WEBUI_AUTH_COOKIE_SECURE = ( ) if WEBUI_AUTH and WEBUI_SECRET_KEY == '': - raise ValueError(ERROR_MESSAGES.ENV_VAR_NOT_FOUND) + raise SystemExit( + 'WEBUI_SECRET_KEY is not set. It is a hard requirement when authentication is enabled.\n' + 'The supported start methods set or auto-generate it for you: use start.sh (Linux/macOS), ' + 'start_windows.bat (Windows), or `open-webui serve`.\n' + 'If you start the backend another way (e.g. invoking uvicorn directly, which is unsupported), ' + 'you must set WEBUI_SECRET_KEY yourself to a long random value.\n' + 'See https://docs.openwebui.com/reference/env-configuration#webui_secret_key' + ) ENABLE_COMPRESSION_MIDDLEWARE = os.getenv('ENABLE_COMPRESSION_MIDDLEWARE', 'True').lower() == 'true'