open-webui/backend/open_webui
Classic298 f6b85700ea
fix: gate OpenAI catch-all proxy behind ENABLE_OPENAI_API_PASSTHROUGH toggle (#23640)
The catch-all /{path:path} proxy forwards any request to the upstream OpenAI-compatible API with the admin's API key and no access control. This is an intentional proxy but should be opt-in.

Adds ENABLE_OPENAI_API_PASSTHROUGH env var (defaults to False). When disabled, the catch-all returns 403. No other routers (Ollama, responses) have catch-all proxies.
2026-04-12 14:26:12 -05:00
..
data refac: mv backend files to /open_webui dir 2024-09-04 16:54:48 +02:00
internal refac: async db 2026-04-12 14:22:11 -05:00
migrations refac 2026-04-01 18:26:46 -05:00
models refac: async db 2026-04-12 14:22:11 -05:00
retrieval refac: async db 2026-04-12 14:22:11 -05:00
routers fix: gate OpenAI catch-all proxy behind ENABLE_OPENAI_API_PASSTHROUGH toggle (#23640) 2026-04-12 14:26:12 -05:00
socket refac: async db 2026-04-12 14:22:11 -05:00
static refac 2026-03-23 23:39:52 -05:00
storage refac 2026-04-12 12:36:21 -05:00
test refac 2026-03-17 17:58:01 -05:00
tools refac: async db 2026-04-12 14:22:11 -05:00
utils refac: async db 2026-04-12 14:22:11 -05:00
__init__.py refac (#22987) 2026-03-24 15:41:26 -05:00
alembic.ini fix: Alembic CLI commands from failing 2025-08-15 04:17:47 -04:00
config.py enh: automation 2026-04-11 17:06:58 -06:00
constants.py refac 2026-03-25 17:29:57 -05:00
env.py fix: gate OpenAI catch-all proxy behind ENABLE_OPENAI_API_PASSTHROUGH toggle (#23640) 2026-04-12 14:26:12 -05:00
functions.py refac: async db 2026-04-12 14:22:11 -05:00
main.py refac: async db 2026-04-12 14:22:11 -05:00
tasks.py refac 2026-03-17 17:58:01 -05:00