From 61f49ff5808c226199b4fff56bd5c6ae53d79b0b Mon Sep 17 00:00:00 2001 From: sasidhar Date: Sun, 8 Jun 2025 14:16:10 +0530 Subject: [PATCH] fix: ensure trusted email header matches logged-in user When using trusted email header authentication, verify that the logged-in user's email matches the value in the header. This prevents session conflicts when the OAuth server changes the authenticated user. - Move trusted email verification after user existence check - Raise 401 if email mismatch is detected - Only perform verification when WEBUI_AUTH_TRUSTED_EMAIL_HEADER is enabled --- backend/open_webui/utils/auth.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/backend/open_webui/utils/auth.py b/backend/open_webui/utils/auth.py index 2db0da7e5..5ff0e7f4e 100644 --- a/backend/open_webui/utils/auth.py +++ b/backend/open_webui/utils/auth.py @@ -23,6 +23,7 @@ from open_webui.env import ( TRUSTED_SIGNATURE_KEY, STATIC_DIR, SRC_LOG_LEVELS, + WEBUI_AUTH_TRUSTED_EMAIL_HEADER, ) from fastapi import BackgroundTasks, Depends, HTTPException, Request, Response, status @@ -225,6 +226,14 @@ def get_current_user( detail=ERROR_MESSAGES.INVALID_TOKEN, ) else: + if WEBUI_AUTH_TRUSTED_EMAIL_HEADER: + trusted_email = request.headers.get(WEBUI_AUTH_TRUSTED_EMAIL_HEADER) + if trusted_email and user.email != trusted_email: + raise HTTPException( + status_code=status.HTTP_401_UNAUTHORIZED, + detail="User mismatch. Please sign in again.", + ) + # Add user info to current span current_span = trace.get_current_span() if current_span: