Classic298 21f770fb73 fix: OAuth 2.1 (Static) MCP connections send no client secret to servers like X Ads (#32818) ... With OAuth 2.1 (Static), when the authorization server did not accept the client secret as a form field, Open WebUI used whichever auth method the server's metadata listed first. X Ads lists "none" (public client, no secret) first, so the token exchange went out without the configured client secret and X rejected it with "Missing valid authorization header". When the server supports HTTP Basic auth, the secret is now sent that way, no matter which method it lists first. Fixes #32813		2026-10-21 16:38:34 +09:00
..
data	refac: mv backend files to /open_webui dir	2024-09-04 16:54:48 +02:00
open_webui	fix: OAuth 2.1 (Static) MCP connections send no client secret to servers like X Ads (#32818)	2026-10-21 16:38:34 +09:00
.dockerignore	fix: litellm config issue	2024-02-24 22:35:11 -08:00
.gitignore	refac	2024-09-06 04:59:20 +02:00
dev.sh	perf: allow disabling websocket per-message-deflate (#28613)	2026-08-24 18:46:07 -04:00
requirements-slim.txt	refac	2026-10-05 12:03:19 +04:00
requirements.txt	feat: tag Valkey vector store connections as Open WebUI (#32428)	2026-10-15 00:00:08 +04:00
start.sh	refac	2026-09-06 16:48:30 -04:00
start_windows.bat	chore: drop nltk, unused at the pinned versions (#29725)	2026-09-06 16:39:05 -04:00