From 2207876ae79389572bf55d7486018a5e87140e05 Mon Sep 17 00:00:00 2001
From: Classic298 <27028174+Classic298@users.noreply.github.com>
Date: Tue, 11 Aug 2026 07:22:43 +0200
Subject: [PATCH] fix: generate valid WEBUI_SECRET_KEY in start_windows.bat
 (#28061)

The key generation loop redirected input from a non-existent file
(`SET /p WEBUI_SECRET_KEY=<!random!>>%KEY_FILE%`), printing "The system
cannot find the file specified." once per iteration and leaving the key
file empty, so startup failed with "WEBUI_SECRET_KEY is not set".

Build a fixed-length alphanumeric key by indexing into a charset with
%RANDOM% and write it once with `<nul set /p`. Also quote the key file
path and use delayed expansion so paths with spaces work.


Claude-Session: https://claude.ai/code/session_01CmgBivWjad68mX4yBVWMi2

Co-authored-by: Claude <noreply@anthropic.com>
---
 backend/start_windows.bat | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/backend/start_windows.bat b/backend/start_windows.bat
index b86beb11e8..d5c4510baa 100644
--- a/backend/start_windows.bat
+++ b/backend/start_windows.bat
@@ -35,16 +35,21 @@ IF "%WEBUI_SECRET_KEY_LENGTH%" == "" (
 IF "%WEBUI_SECRET_KEY% %WEBUI_JWT_SECRET_KEY%" == " " (
     echo Loading WEBUI_SECRET_KEY from file, not provided as an environment variable.
 
-    IF NOT EXIST "%KEY_FILE%" (
+    IF NOT EXIST "!KEY_FILE!" (
         echo Generating WEBUI_SECRET_KEY
         :: Generate a random value to use as a WEBUI_SECRET_KEY in case the user didn't provide one
-        SET /p WEBUI_SECRET_KEY=<nul
-        FOR /L %%i IN (1,1,%WEBUI_SECRET_KEY_LENGTH%) DO SET /p WEBUI_SECRET_KEY=<!random!>>%KEY_FILE%
+        SET "CHARSET=0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
+        SET "WEBUI_SECRET_KEY="
+        FOR /L %%i IN (1,1,!WEBUI_SECRET_KEY_LENGTH!) DO (
+            SET /A "INDEX=!RANDOM! %% 62"
+            FOR %%j IN (!INDEX!) DO SET "WEBUI_SECRET_KEY=!WEBUI_SECRET_KEY!!CHARSET:~%%j,1!"
+        )
+        <nul SET /p="!WEBUI_SECRET_KEY!">"!KEY_FILE!"
         echo WEBUI_SECRET_KEY generated
     )
 
-    echo Loading WEBUI_SECRET_KEY from %KEY_FILE%
-    SET /p WEBUI_SECRET_KEY=<%KEY_FILE%
+    echo Loading WEBUI_SECRET_KEY from !KEY_FILE!
+    SET /p WEBUI_SECRET_KEY=<"!KEY_FILE!"
 )
 
 :: Execute uvicorn