scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-09-17 23:52:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
open-webui/backend/open_webui/utils
History
Justin Williams 478bc9e3f1
fix(oauth): use Protected Resource Metadata scopes in static OAuth 2.1 flow (#24690) 
The static credentials OAuth flow currently sets scope=None, relying on
the OAuth provider's default scopes. This breaks providers like GitHub
that default to minimal/public-only access when no scope is requested.

This change reads scopes_supported from the Protected Resource Metadata
document (RFC 9728) and uses them in the authorization request. Unlike
the Authorization Server's scopes_supported (a full catalog of every
scope the AS can grant), the PRM scopes_supported represents what the
specific resource requires — making it safe to request without breaking
providers like Entra ID that reject broad scope requests.

Fixes the regression introduced in 349ea4ea where all scope handling was
removed from the static flow.
2026-06-01 13:52:18 -07:00
..
access_control fix: respect access_type in shared-chat file authorization branch (#24755) 2026-05-19 22:09:56 +04:00
images refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
mcp refac 2026-06-01 12:44:16 -07:00
telemetry refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
actions.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
anthropic.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
asgi_middleware.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
audit.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
auth.py fix(auth): use request.scope["path"] to prevent CVE-2026-48710 (BadHost) (#25123) 2026-05-28 16:41:56 -05:00
automations.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
calendar.py feat: calendar 2026-04-19 19:15:05 +09:00
channels.py refac 2026-03-17 17:58:01 -05:00
chat.py fix: move bypass_system_prompt off query parameter onto request.state (#25156) 2026-05-31 14:53:53 -07:00
code_interpreter.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
embeddings.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
files.py fix: get_image_base64_from_file_id 2026-05-19 20:33:46 +04:00
filter.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
groups.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
headers.py refac 2026-05-19 21:35:04 +04:00
logger.py refac 2026-05-28 16:33:48 -05:00
middleware.py refactor: move background tasks handler call to ensure consistent execution in chat response handlers (#24717) 2026-06-01 13:50:15 -07:00
misc.py refac 2026-06-01 12:37:34 -07:00
models.py refac 2026-06-01 12:27:08 -07:00
oauth.py fix(oauth): use Protected Resource Metadata scopes in static OAuth 2.1 flow (#24690) 2026-06-01 13:52:18 -07:00
payload.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
pdf_generator.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
plugin.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
rate_limit.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
redis.py refac: clean up Redis sentinel utilities and import grouping 2026-05-21 11:47:25 +04:00
response.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
sanitize.py refac 2026-03-17 17:58:01 -05:00
security_headers.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
session_pool.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
task.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
tools.py fix: log expected fetch/transcript/tool-server failures as warnings (#24903) 2026-05-19 21:55:40 +04:00
validate.py feat: cap profile image data URI size to bound model/avatar bloat (#25476) 2026-06-01 09:57:06 -07:00
webhook.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00