scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-09 03:18:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

refac

Browse source
This commit is contained in:
Timothy Jaeryang Baek 2026-04-12 19:02:51 -05:00
parent c3c8c605d7
commit facb194a07
1 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
backend/open_webui/utils/oauth.py
View file

@ -18,6 +18,7 @@ from typing import Literal
import aiohttp
from authlib.integrations.starlette_client import OAuth
from authlib.jose.errors import BadSignatureError
from authlib.oidc.core import UserInfo
from fastapi import (
HTTPException,
@ -1392,6 +1393,27 @@ class OAuthManager:
try:
token = await client.authorize_access_token(request, **auth_params)
except BadSignatureError:
# The IdP likely rotated its signing keys and the cached JWKS
# is stale. Evict the cached key set so the next attempt
# fetches fresh keys from the jwks_uri.
log.warning(
'OIDC bad_signature for provider %s — evicting cached JWKS and retrying',
provider,
)
if hasattr(client, 'server_metadata') and isinstance(client.server_metadata, dict):
client.server_metadata.pop('jwks', None)
try:
token = await client.authorize_access_token(request, **auth_params)
except Exception as retry_exc:
detailed_error = _build_oauth_callback_error_message(retry_exc)
log.warning(
'OAuth callback error during authorize_access_token retry for provider %s: %s',
provider,
detailed_error,
exc_info=True,
)
raise HTTPException(400, detail=ERROR_MESSAGES.INVALID_CRED)
except Exception as e:
detailed_error = _build_oauth_callback_error_message(e)
log.warning(