Classic298 f7c8ad012d fix: requests authenticated with the x-api-key header are missing from the audit log (#32443) ... With audit logging on, requests that used an API key in the x-api-key header (what Anthropic SDKs send) worked but never showed up in the audit log, because the audit check only looked for a Bearer token or a session cookie. These requests are now logged with the user the key belongs to, and this also covers a custom header set through CUSTOM_API_KEY_HEADER. Failed attempts with a wrong key in that header now appear in the log without a user, just like a wrong Bearer key. A malformed Authorization header with no other credential is no longer logged, since it can never authenticate.		2026-10-15 13:59:03 +04:00
..
data	refac: mv backend files to /open_webui dir	2024-09-04 16:54:48 +02:00
open_webui	fix: requests authenticated with the x-api-key header are missing from the audit log (#32443)	2026-10-15 13:59:03 +04:00
.dockerignore	fix: litellm config issue	2024-02-24 22:35:11 -08:00
.gitignore	refac	2024-09-06 04:59:20 +02:00
dev.sh	perf: allow disabling websocket per-message-deflate (#28613)	2026-08-24 18:46:07 -04:00
requirements-slim.txt	refac	2026-10-05 12:03:19 +04:00
requirements.txt	feat: tag Valkey vector store connections as Open WebUI (#32428)	2026-10-15 00:00:08 +04:00
start.sh	refac	2026-09-06 16:48:30 -04:00
start_windows.bat	chore: drop nltk, unused at the pinned versions (#29725)	2026-09-06 16:39:05 -04:00