Classic298 83024d00bb fix: enforce API key endpoint restrictions at the auth layer, not middleware (#23637) ...

The APIKeyRestrictionMiddleware only inspected the Authorization header for sk- tokens, but get_current_user also reads API keys from cookies and x-api-key headers. This allowed complete bypass of endpoint restrictions by sending the key via an alternate transport.

Moves the restriction check into get_current_user_by_api_key so it runs regardless of how the API key was delivered. Removes the now-redundant middleware.

2026-04-12 16:33:41 -05:00

..

data

refac: mv backend files to /open_webui dir

2024-09-04 16:54:48 +02:00

internal

refac: async db

2026-04-12 14:22:11 -05:00

migrations

refac

2026-04-01 18:26:46 -05:00

models

refac: async db

2026-04-12 14:22:11 -05:00

retrieval

refac: async db

2026-04-12 14:22:11 -05:00

routers

fix: enforce filter_allowed_access_grants on channel create and update (#23638)

2026-04-12 16:27:44 -05:00

socket

fix: invalidate stale Socket.IO sessions on role change and user deletion (#23642)

2026-04-12 16:19:38 -05:00

static

refac

2026-03-23 23:39:52 -05:00

storage

refac

2026-04-12 12:36:21 -05:00

test

refac

2026-03-17 17:58:01 -05:00

tools

refac

2026-04-12 14:39:23 -05:00

utils

fix: enforce API key endpoint restrictions at the auth layer, not middleware (#23637)

2026-04-12 16:33:41 -05:00

__init__.py

refac (#22987)

2026-03-24 15:41:26 -05:00

alembic.ini

fix: Alembic CLI commands from failing

2025-08-15 04:17:47 -04:00

config.py

enh: automation

2026-04-11 17:06:58 -06:00

constants.py

refac

2026-03-25 17:29:57 -05:00

env.py

refac

2026-04-12 16:25:01 -05:00

functions.py

refac: async db

2026-04-12 14:22:11 -05:00

main.py

fix: enforce API key endpoint restrictions at the auth layer, not middleware (#23637)

2026-04-12 16:33:41 -05:00

tasks.py

refac

2026-03-17 17:58:01 -05:00