close
Skip to content

add environment variable configuration for Open WebUI to disable auth#781

Merged
ericcurtin merged 1 commit intomainfrom
open-webui-defaults
Mar 24, 2026
Merged

add environment variable configuration for Open WebUI to disable auth#781
ericcurtin merged 1 commit intomainfrom
open-webui-defaults

Conversation

@ilopezluna
Copy link
Copy Markdown
Contributor

This pull request updates the environment variable handling for the Open WebUI container app to ensure authentication is disabled by default.

@ilopezluna ilopezluna requested a review from a team March 24, 2026 10:04
Copy link
Copy Markdown
Contributor

@sourcery-ai sourcery-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've left some high level feedback:

  • Hardcoding WEBUI_AUTH=false in openwebuiEnv removes any way to enable auth through this CLI; consider making this configurable (e.g., via a flag or environment variable) while still defaulting to false.
  • Since openwebuiEnv just decorates openaiEnv(openaiPathSuffix), you could reduce duplication and keep behavior consistent by exposing a helper like openaiEnvWithAuthDisabled or by passing an options struct instead of hardcoding the extra WEBUI_AUTH entry in a separate function.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- Hardcoding `WEBUI_AUTH=false` in `openwebuiEnv` removes any way to enable auth through this CLI; consider making this configurable (e.g., via a flag or environment variable) while still defaulting to `false`.
- Since `openwebuiEnv` just decorates `openaiEnv(openaiPathSuffix)`, you could reduce duplication and keep behavior consistent by exposing a helper like `openaiEnvWithAuthDisabled` or by passing an options struct instead of hardcoding the extra `WEBUI_AUTH` entry in a separate function.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

The pull request successfully introduces an environment variable configuration to disable authentication for Open WebUI by default. The changes correctly update the envFn for Open WebUI to use a new openwebuiEnv function, which appends WEBUI_AUTH=false. The accompanying tests adequately cover this new functionality and ensure the environment variable is correctly applied and reflected in configuration outputs.


// openwebuiEnv returns environment variables for Open WebUI with Docker Model Runner.
func openwebuiEnv(baseURL string) []string {
return append(openaiEnv(openaiPathSuffix)(baseURL), "WEBUI_AUTH=false")
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

Setting WEBUI_AUTH=false by default significantly impacts the security posture of the Open WebUI application by disabling authentication. While this aligns with the pull request's objective, it's crucial to ensure that users are explicitly aware of this default behavior and its security implications, especially if the application is exposed to untrusted networks. Consider adding a prominent note in the documentation or CLI output when launching Open WebUI with this setting, advising users on how to re-enable authentication if needed for production environments.

@ericcurtin ericcurtin merged commit fc7f5ea into main Mar 24, 2026
15 checks passed
@ericcurtin ericcurtin deleted the open-webui-defaults branch March 24, 2026 10:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants