[PR #277] fix: keep configured SSO callbacks in the desktop session #239

New issue

Open

opened 2026-10-18 14:07:14 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 14:07:14 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/open-webui/desktop/pull/277
Author: @aigens-hans
Created: 10/1/2026
Status: 🔄 Open

Base: main ← Head: codex/fix-sso-navigation

📝 Commits (1)

acb6a0b fix: preserve configured SSO navigation in connection sessions

📊 Changes

6 files changed (+172 additions, -3 deletions)

View changed files

📝 README.md (+29 -0)
📝 package.json (+2 -1)
📝 src/main/index.ts (+12 -2)
➕ src/main/utils/auth-navigation.ts (+35 -0)
📝 src/main/utils/index.ts (+1 -0)
➕ tests/auth-navigation.test.mjs (+93 -0)

📄 Description

OAuth login can finish at the identity provider but leave Desktop stuck: the webview's will-navigate handler opens the callback in the default browser whenever its origin differs from the current page. The external browser does not share the connection's OAuth state/PKCE cookies.

Add optional per-connection authOrigins configuration. Navigation between the Open WebUI server and explicitly configured HTTPS identity-provider origins remains in the connection's webview/session. Match the guest's session to its connection rather than using the active sidebar connection, so background webviews cannot inherit another connection's policy. Unconfigured connections, unrelated links, and popup handling retain their existing behavior.

The README documents configuration paths and an example. Entries with paths, credentials, queries, fragments, wildcards, or insecure schemes are ignored.

Validation:

npm test: six regression tests covering the federated callback chain, opt-in behavior, lookalike hosts, scheme/port mismatches, malformed configuration, and isolation between connections.
npm run build: passed, including TypeScript and Svelte checks; existing renderer accessibility warnings remain.
ESLint passes for the new helper and test. The two modified existing source files have the same 203 diagnostics as upstream HEAD (161 + 42); no new diagnostics.
Live macOS reproduction on Desktop 0.0.20: the original callback opened externally and produced the portal's configuration error. A locally patched copy using the equivalent explicit HTTPS-origin allowlist completed the full federated login inside Desktop and displayed the authenticated chat composer. The generalized configuration wiring in this PR was tested through build and regression tests; it was not separately packaged for a second live login.

No new dependencies. The test command uses Node's built-in TypeScript stripping (Node 22.6+).

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/desktop/pull/277 **Author:** [@aigens-hans](https://github.com/aigens-hans) **Created:** 10/1/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `codex/fix-sso-navigation` --- ### 📝 Commits (1) - [`acb6a0b`](https://github.com/open-webui/desktop/commit/acb6a0b97b9a6aa32720fa3ceedecd220fee9c3a) fix: preserve configured SSO navigation in connection sessions ### 📊 Changes **6 files changed** (+172 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+29 -0) 📝 `package.json` (+2 -1) 📝 `src/main/index.ts` (+12 -2) ➕ `src/main/utils/auth-navigation.ts` (+35 -0) 📝 `src/main/utils/index.ts` (+1 -0) ➕ `tests/auth-navigation.test.mjs` (+93 -0) </details> ### 📄 Description OAuth login can finish at the identity provider but leave Desktop stuck: the webview's `will-navigate` handler opens the callback in the default browser whenever its origin differs from the current page. The external browser does not share the connection's OAuth state/PKCE cookies. Add optional per-connection `authOrigins` configuration. Navigation between the Open WebUI server and explicitly configured HTTPS identity-provider origins remains in the connection's webview/session. Match the guest's session to its connection rather than using the active sidebar connection, so background webviews cannot inherit another connection's policy. Unconfigured connections, unrelated links, and popup handling retain their existing behavior. The README documents configuration paths and an example. Entries with paths, credentials, queries, fragments, wildcards, or insecure schemes are ignored. Validation: - `npm test`: six regression tests covering the federated callback chain, opt-in behavior, lookalike hosts, scheme/port mismatches, malformed configuration, and isolation between connections. - `npm run build`: passed, including TypeScript and Svelte checks; existing renderer accessibility warnings remain. - ESLint passes for the new helper and test. The two modified existing source files have the same 203 diagnostics as upstream HEAD (161 + 42); no new diagnostics. - Live macOS reproduction on Desktop 0.0.20: the original callback opened externally and produced the portal's configuration error. A locally patched copy using the equivalent explicit HTTPS-origin allowlist completed the full federated login inside Desktop and displayed the authenticated chat composer. The generalized configuration wiring in this PR was tested through build and regression tests; it was not separately packaged for a second live login. No new dependencies. The test command uses Node's built-in TypeScript stripping (Node 22.6+). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-18 14:07:14 +00:00

No labels

help wanted

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

open-webui/desktop#239

No description provided.

Rows
Columns