OpenWebUI/docs
1
0
Fork 0
mirror of https://github.com/open-webui/docs synced 2025-05-19 18:58:41 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Merge pull request #369 from antpyykk-kone/feature/add-auth-cookie-security-option-docs

Browse Source 
Add docs for new security variables WEBUI_AUTH_COOKIE_SAME_SITE & WEBUI_AUTH_COOKIE_SECURE
This commit is contained in:
Timothy Jaeryang Baek 2025-01-29 14:52:48 -08:00 committed by GitHub
commit 6a23132cd5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 40 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
docs/getting-started/advanced-topics/env-configuration.md
View File

@ -597,12 +597,52 @@ requests initiated by third-party websites, but only over HTTPS.
- Default: `lax` - Default: `lax`
- Description: Sets the `SameSite` attribute for session cookies. - Description: Sets the `SameSite` attribute for session cookies.
:::warning
When `ENABLE_OAUTH_SIGNUP` is enabled, setting `WEBUI_SESSION_COOKIE_SAME_SITE` to `strict` can cause login failures. This is because Open WebUI uses a session cookie to validate the callback from the OAuth provider, which helps prevent CSRF attacks.
However, a `strict` session cookie is not sent with the callback request, leading to potential login issues. If you experience this problem, use the default `lax` value instead.
:::
#### `WEBUI_SESSION_COOKIE_SECURE` #### `WEBUI_SESSION_COOKIE_SECURE`
- Type: `bool` - Type: `bool`
- Default: `False` - Default: `False`
- Description: Sets the `Secure` attribute for session cookies if set to `True`. - Description: Sets the `Secure` attribute for session cookies if set to `True`.
#### `WEBUI_AUTH_COOKIE_SAME_SITE`
- Type: `str` (enum: `lax`, `strict`, `none`)
- Options:
- `lax` - Sets the `SameSite` attribute to lax, allowing auth cookies to be sent with
requests initiated by third-party websites.
- `strict` - Sets the `SameSite` attribute to strict, blocking auth cookies from being sent
with requests initiated by third-party websites.
- `none` - Sets the `SameSite` attribute to none, allowing auth cookies to be sent with
requests initiated by third-party websites, but only over HTTPS.
- Default: `lax`
- Description: Sets the `SameSite` attribute for auth cookies.
:::info
If the value is not set, `WEBUI_SESSION_COOKIE_SAME_SITE` will be used as a fallback.
:::
#### `WEBUI_AUTH_COOKIE_SECURE`
- Type: `bool`
- Default: `False`
- Description: Sets the `Secure` attribute for auth cookies if set to `True`.
:::info
If the value is not set, `WEBUI_SESSION_COOKIE_SECURE` will be used as a fallback.
:::
#### `WEBUI_AUTH` #### `WEBUI_AUTH`
- Type: `bool` - Type: `bool`