Classic298 f7c8ad012d fix: requests authenticated with the x-api-key header are missing from the audit log (#32443) ...

With audit logging on, requests that used an API key in the x-api-key header (what Anthropic SDKs send) worked but never showed up in the audit log, because the audit check only looked for a Bearer token or a session cookie. These requests are now logged with the user the key belongs to, and this also covers a custom header set through CUSTOM_API_KEY_HEADER. Failed attempts with a wrong key in that header now appear in the log without a user, just like a wrong Bearer key. A malformed Authorization header with no other credential is no longer logged, since it can never authenticate.

2026-10-15 13:59:03 +04:00

..

data

refac: mv backend files to /open_webui dir

2024-09-04 16:54:48 +02:00

open_webui

fix: requests authenticated with the x-api-key header are missing from the audit log (#32443)

2026-10-15 13:59:03 +04:00

.dockerignore

…

.gitignore

refac

2024-09-06 04:59:20 +02:00

dev.sh

perf: allow disabling websocket per-message-deflate (#28613)

2026-08-24 18:46:07 -04:00

requirements-slim.txt

refac

2026-10-05 12:03:19 +04:00

requirements.txt

feat: tag Valkey vector store connections as Open WebUI (#32428)

2026-10-15 00:00:08 +04:00

start_windows.bat

chore: drop nltk, unused at the pinned versions (#29725)

2026-09-06 16:39:05 -04:00

start.sh

refac

2026-09-06 16:48:30 -04:00