Classic298 21f770fb73 fix: OAuth 2.1 (Static) MCP connections send no client secret to servers like X Ads (#32818) ...

With OAuth 2.1 (Static), when the authorization server did not accept the client secret as a form field, Open WebUI used whichever auth method the server's metadata listed first. X Ads lists "none" (public client, no secret) first, so the token exchange went out without the configured client secret and X rejected it with "Missing valid authorization header". When the server supports HTTP Basic auth, the secret is now sent that way, no matter which method it lists first.

Fixes #32813

2026-10-21 16:38:34 +09:00

..

data

…

internal

fix: requests hang or fail with 503 after pages are closed while loading (#32617)

2026-10-21 03:23:05 +09:00

migrations

refac

2026-10-14 18:49:51 +04:00

models

refac

2026-10-21 16:35:31 +09:00

retrieval

refac

2026-10-21 03:44:42 +09:00

routers

refac

2026-10-21 16:35:31 +09:00

socket

refac

2026-10-16 14:48:08 +04:00

static

…

storage

refac

2026-10-05 12:03:19 +04:00

tools

refac

2026-10-21 09:53:09 +09:00

utils

fix: OAuth 2.1 (Static) MCP connections send no client secret to servers like X Ads (#32818)

2026-10-21 16:38:34 +09:00

__init__.py

refac

2026-10-05 12:17:25 +04:00

alembic.ini

…

config.py

refac

2026-10-16 18:58:58 +04:00

constants.py

fix: SSO login failures show the email/password error (#31629)

2026-09-30 19:07:49 +04:00

env.py

refac

2026-10-01 03:31:20 +04:00

events.py

refac

2026-10-08 14:30:07 +04:00

functions.py

fix: pipes and tools get None instead of a file list when nothing is attached (#32380)

2026-10-14 12:18:55 +04:00

main.py

refac

2026-10-16 02:46:20 +04:00

tasks.py

refac

2026-10-16 04:20:53 +04:00