{"record":{"id":"1ed5f6d37f82d059","repo":"open-webui/open-webui","slug":"oauth-client-registration-is-still-invalid-after-r","errorCode":null,"errorMessage":"OAuth client registration is still invalid after re-registration","messagePattern":"OAuth client registration is still invalid after re-registration","errorType":"http","errorClass":"HTTPException","httpStatus":500,"severity":"error","filePath":"backend/open_webui/main.py","lineNumber":2624,"sourceCode":"        )\n\n        registered = await register_client(request, client_id)\n        if not registered:\n            raise HTTPException(\n                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,\n                detail='Failed to re-register OAuth client',\n            )\n\n        client = await oauth_client_manager.get_client(client_id)\n        client_info = await oauth_client_manager.get_client_info(client_id)\n        if client is None or client_info is None:\n            raise HTTPException(\n                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,\n                detail='OAuth client unavailable after re-registration',\n            )\n\n        if not await oauth_client_manager._preflight_authorization_url(client, client_info):\n            raise HTTPException(\n                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,\n                detail='OAuth client registration is still invalid after re-registration',\n            )\n\n    return await oauth_client_manager.handle_authorize(request, client_id=client_id)\n\n\n@app.get('/oauth/clients/{client_id}/callback')\nasync def oauth_client_callback(\n    client_id: str,\n    request: Request,\n    response: Response,\n    user=Depends(get_verified_user),\n):\n    return await oauth_client_manager.handle_callback(\n        request,\n        client_id=client_id,\n        user_id=user.id if user else None,","sourceCodeStart":2606,"sourceCodeEnd":2642,"githubUrl":"https://github.com/open-webui/open-webui/blob/01f4282f1ffe0d6212f58d3afbeae21fffd0c4be/backend/open_webui/main.py#L2606-L2642","documentation":"Final 500 in the authorize endpoint's self-healing chain: the client record was refetched successfully after re-registration, but _preflight_authorization_url(client, client_info) still fails — the reconstructed authorization URL remains invalid. Re-registration reproduced the same broken registration, so the repair loop gives up.","triggerScenarios":"Systemic misconfiguration that re-registration cannot fix: wrong issuer/authorization endpoint discovered from the provider metadata, redirect URI mismatch that DCR does not validate, or a public URL (WEBUI_URL/domain) configured incorrectly so generated authorization URLs are malformed.","commonSituations":"Open WebUI deployed behind a proxy with wrong X-Forwarded-* headers or WEBUI_URL set to an internal hostname; provider metadata endpoint returning a private/wrong issuer; scheme mismatch (http vs https) between redirect URI and provider requirement.","solutions":["Verify the instance's public URL configuration (WEBUI_URL / proxy headers) — the authorization URL is built from it and must match the IdP's registered redirect URI exactly, including scheme and port.","Compare the provider's advertised authorization_endpoint (.well-known/openid-configuration) with what the preflight builds; fix issuer/discovery config if they diverge.","If the provider requires pre-registered static redirect URIs, register them out-of-band instead of relying on DCR.","Capture the exact URL preflight rejects (add temporary logging around _preflight_authorization_url) and correct the component that is wrong."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const authUrl = buildAuthorizationUrl(client, clientInfo);\nconst expectedOrigin = new URL(WEBUI_URL).origin;\nif (new URL(authUrl.redirect_uri).origin !== expectedOrigin) throw new Error('redirect URI origin mismatch — fix WEBUI_URL/proxy headers');","typeGuard":null,"tryCatchPattern":"try { await authorize(id) } catch (e) { if (e.status === 500 && /still invalid/.test(e.detail)) { haltAutoRepair(); surfaceConfigError(); } else throw e; }","preventionTips":["Set WEBUI_URL to the exact public origin including scheme","Configure X-Forwarded-Proto/Host correctly behind proxies","Diff the generated authorization URL against the IdP's registered redirect URIs"],"tags":["oauth","authorization-url","http-500","reverse-proxy","open-webui"],"backgroundTag":null,"analyzedSha":"01f4282f1ffe0d6212f58d3afbeae21fffd0c4be","analyzedAt":"2026-08-14T18:25:22.715Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}