Classic298 ae6793dd4f fix: OAuth token refresh ignores the client_secret_basic auth method (#32507) ... When Open WebUI authenticates to the OAuth provider with client_secret_basic, either because OAUTH_TOKEN_ENDPOINT_AUTH_METHOD is set to it or because an MCP tool server's OAuth provider only offers that method, sign-in sent the client ID and secret in an HTTP Basic header but the token refresh always put them in the request body. Providers that only accept Basic rejected every refresh with invalid_client, so once the access token expired Open WebUI deleted the user's saved OAuth tokens, and model connections and tool servers set to forward the user's OAuth token stopped working until the user signed in again. The refresh now authenticates the same way sign-in does for client_secret_basic, with the credentials only in the Basic header. Setups using client_secret_post, or leaving the setting unset, still send the credentials in the request body exactly as before. Fixes #32506		2026-10-16 03:01:35 +04:00
..
access_control	refac	2026-10-15 17:56:56 +04:00
images	fix: show ComfyUI images saved by the Save Image (Advanced) node (#30420)	2026-09-23 23:54:58 -04:00
mcp	refac	2026-10-10 23:50:29 +04:00
telemetry	fix: every log line is exported twice to the OpenTelemetry collector when traces and logs are both on (#31528)	2026-09-30 19:36:43 +04:00
actions.py	refac	2026-10-01 03:31:20 +04:00
anthropic.py	fix: Anthropic API streams report a failed response as a finished one (#31405)	2026-09-27 23:20:50 +04:00
apps.py	refac	2026-10-14 17:10:08 +04:00
asgi_middleware.py	refac	2026-08-24 18:29:36 -04:00
ask_user.py	fix: a rejected ask_user call ending the turn with no reply (#29252)	2026-08-31 00:17:21 -04:00
audit.py	fix: requests authenticated with the x-api-key header are missing from the audit log (#32443)	2026-10-15 13:59:03 +04:00
auth.py	refac	2026-10-05 12:17:25 +04:00
automations.py	refac	2026-10-14 23:58:58 +04:00
calendar.py	fix: Scheduled Tasks calendar shows extra runs for automations with a run count (#31604)	2026-09-30 19:43:41 +04:00
channels.py	refac	2026-10-12 17:29:04 +04:00
chat.py	fix: keep the model system prompt on Ollama tool-call follow-ups (#30375)	2026-09-22 16:47:20 -04:00
chat_fork.py	refac	2026-07-23 02:54:56 -04:00
chat_id.py	refac	2026-07-26 21:12:14 -04:00
chat_variables.py	refac: chat variable property value parsing (#30389)	2026-10-08 15:48:33 -05:00
code_interpreter.py	refac	2026-07-31 17:41:14 -04:00
context_compaction.py	refac	2026-10-14 18:35:56 +04:00
embeddings.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
files.py	refac(images): request an unencoded body when fetching remote chat images (#29623)	2026-09-21 08:53:06 -04:00
filter.py	refac	2026-10-01 03:31:20 +04:00
groups.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
headers.py	feat: add {{MODEL_ID}} placeholder for custom connection headers (#32426)	2026-10-15 00:00:41 +04:00
json_codec.py	perf: write task payloads to Redis as bytes (#28833)	2026-08-20 12:58:52 -07:00
json_response.py	perf: optional orjson JSON codec behind ENABLE_ORJSON (#27583)	2026-07-27 03:45:37 -04:00
logger.py	feat: record the requested model as its own field in the audit log (#32429)	2026-10-15 00:00:19 +04:00
memory.py	fix: stop the background memory review when memory is switched off (#30309)	2026-09-21 11:22:21 -04:00
mfa.py	fix: name the secret key when stored MFA secrets cannot be decrypted at startup (#32189)	2026-10-10 20:10:39 +04:00
middleware.py	fix: an approved knowledge or file tool loses its sources (#32439)	2026-10-15 00:28:23 +04:00
misc.py	refac	2026-10-14 23:21:22 +04:00
model_ids.py	refac	2026-07-26 23:09:22 -04:00
models.py	chore: format	2026-10-10 23:18:09 +04:00
notifications.py	fix: chat links in finished and failed webhook notifications open a 404 (#31572)	2026-09-30 19:05:45 +04:00
oauth.py	fix: OAuth token refresh ignores the client_secret_basic auth method (#32507)	2026-10-16 03:01:35 +04:00
payload.py	fix: messages to a model fail after the admin removes a model control the user had set (#32197)	2026-10-10 20:11:47 +04:00
plugin.py	refac	2026-10-09 18:37:55 +04:00
rate_limit.py	fix: stop the sign-in rate limiter blocking the loop and leaking memory (#29977)	2026-09-13 20:28:41 -05:00
recurrence.py	fix: daily, weekly and monthly automations can run twice or skip their first run (#32264)	2026-10-12 18:51:03 +04:00
redis.py	fix: cannot connect through Redis Sentinels that require a password (#32241)	2026-10-12 11:42:26 +04:00
response.py	feat: pass the provider's finish reason to outlet filters (#32079)	2026-10-08 19:36:47 +04:00
sanitize.py	refac	2026-03-17 17:58:01 -05:00
security_headers.py	refac	2026-08-24 18:29:36 -04:00
session_pool.py	fix: long streamed lines no longer abort the response (#28114)	2026-08-25 12:16:37 -04:00
skill_files.py	refac	2026-10-14 18:11:14 +04:00
skills.py	fix: chat title shows raw skill syntax when it is named after the first message (#32176)	2026-10-10 19:47:46 +04:00
subagents.py	refac	2026-10-11 00:55:58 +04:00
task.py	fix: show follow-up suggestions when the task model adds text around its JSON (#32323)	2026-10-13 16:46:17 +04:00
terminals.py	refac	2026-10-13 19:10:21 +04:00
timers.py	feat: Dynamic Tool Loading / Lazy Loading	2026-10-10 22:43:52 +04:00
tool_approval.py	chore: format	2026-10-10 23:18:09 +04:00
tool_search.py	refac	2026-10-14 23:21:22 +04:00
tools.py	refac	2026-10-13 20:04:28 +04:00
validate.py	refac	2026-09-15 22:47:03 -04:00
valves.py	fix: functions and tools with a required Valves field cannot be saved (#32165)	2026-10-10 19:59:52 +04:00
voice_avatar.py	refac	2026-10-11 15:55:57 +04:00
webhook.py	perf: build debug log messages lazily so disabled debug logs cost nothing (#27834)	2026-07-31 19:09:01 -05:00