From f7c8ad012ddcf458c39cdf8a96b41c410655196c Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Thu, 15 Oct 2026 11:59:03 +0200 Subject: [PATCH] fix: requests authenticated with the x-api-key header are missing from the audit log (#32443) With audit logging on, requests that used an API key in the x-api-key header (what Anthropic SDKs send) worked but never showed up in the audit log, because the audit check only looked for a Bearer token or a session cookie. These requests are now logged with the user the key belongs to, and this also covers a custom header set through CUSTOM_API_KEY_HEADER. Failed attempts with a wrong key in that header now appear in the log without a user, just like a wrong Bearer key. A malformed Authorization header with no other credential is no longer logged, since it can never authenticate. --- backend/open_webui/utils/audit.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/open_webui/utils/audit.py b/backend/open_webui/utils/audit.py index e5ff7564c1..b1d996eca6 100644 --- a/backend/open_webui/utils/audit.py +++ b/backend/open_webui/utils/audit.py @@ -264,8 +264,8 @@ class AuditLoggingMiddleware: return False # Do NOT skip logging for auth endpoints # Skip logging if the request is not authenticated - # Check both Authorization header (API keys) and token cookie (browser sessions) - if not request.headers.get('authorization') and not request.cookies.get('token'): + # Token is set by AppHTTPMiddleware from any accepted credential + if not getattr(request.state, 'token', None): return True # Whitelist mode: only log paths that match included_paths