mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-20 00:11:27 +00:00
f2650353da
The 't0p-s3cr3t' default was dead code on every supported startup path: start.sh, start_windows.bat and `open-webui serve` all set or auto-generate WEBUI_SECRET_KEY before the backend imports env.py. It was only ever reachable by invoking uvicorn directly, which is unsupported and unsafe (the app would then sign tokens/cookies with a public, hardcoded key). It also keeps getting reported as a vulnerability because it looks dangerous, even though it is unreachable in practice. Drop the fallback (default to '') so an unset key is caught by the existing WEBUI_AUTH guard, and replace the vague error with a clear, actionable message explaining that the key is a hard requirement and how the supported start methods provide it. Exit cleanly via SystemExit instead of raising a ValueError traceback. WEBUI_AUTH=False keeps working unchanged (key defaults to ''). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| data | ||
| internal | ||
| migrations | ||
| models | ||
| retrieval | ||
| routers | ||
| socket | ||
| static | ||
| storage | ||
| tools | ||
| utils | ||
| __init__.py | ||
| alembic.ini | ||
| config.py | ||
| constants.py | ||
| env.py | ||
| functions.py | ||
| main.py | ||
| tasks.py | ||