scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-18 04:43:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: requests authenticated with the x-api-key header are missing from the audit log (#32443)

Browse source 
With audit logging on, requests that used an API key in the x-api-key header (what Anthropic SDKs send) worked but never showed up in the audit log, because the audit check only looked for a Bearer token or a session cookie. These requests are now logged with the user the key belongs to, and this also covers a custom header set through CUSTOM_API_KEY_HEADER. Failed attempts with a wrong key in that header now appear in the log without a user, just like a wrong Bearer key. A malformed Authorization header with no other credential is no longer logged, since it can never authenticate.
This commit is contained in:
Classic298 2026-10-15 11:59:03 +02:00 • committed by GitHub
parent 08f6023427
commit f7c8ad012d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
backend/open_webui/utils/audit.py
View file

@ -264,8 +264,8 @@ class AuditLoggingMiddleware:
return False # Do NOT skip logging for auth endpoints
# Skip logging if the request is not authenticated
# Check both Authorization header (API keys) and token cookie (browser sessions)
if not request.headers.get('authorization') and not request.cookies.get('token'):
# Token is set by AppHTTPMiddleware from any accepted credential
if not getattr(request.state, 'token', None):
return True
# Whitelist mode: only log paths that match included_paths