open-webui

mirror of https://github.com/open-webui/open-webui.git synced 2026-06-13 19:20:05 +00:00

Files

T

Justin Williams 478bc9e3f1 fix(oauth): use Protected Resource Metadata scopes in static OAuth 2.1 flow (#24690 )

The static credentials OAuth flow currently sets scope=None, relying on
the OAuth provider's default scopes. This breaks providers like GitHub
that default to minimal/public-only access when no scope is requested.

This change reads scopes_supported from the Protected Resource Metadata
document (RFC 9728) and uses them in the authorization request. Unlike
the Authorization Server's scopes_supported (a full catalog of every
scope the AS can grant), the PRM scopes_supported represents what the
specific resource requires — making it safe to request without breaking
providers like Entra ID that reject broad scope requests.

Fixes the regression introduced in 349ea4ea where all scope handling was
removed from the static flow.

2026-06-01 13:52:18 -07:00

data

…

open_webui

fix(oauth): use Protected Resource Metadata scopes in static OAuth 2.1 flow (#24690 )

2026-06-01 13:52:18 -07:00

.dockerignore

…

.gitignore

…

dev.sh

refac