[PR #1423] [CLOSED] docs: correct the reverse proxy pages against the socket, cookie, forwarded-header and startup code #1388

New issue

Closed

opened 2026-10-18 14:19:19 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 14:19:19 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/open-webui/docs/pull/1423
Author: @silentoplayz
Created: 9/18/2026
Status: ❌ Closed

Base: main ← Head: docs/reverse-proxy-pages

📝 Commits (1)

f2264fa docs: correct the reverse proxy pages against the socket, cookie, forwarded-header and startup code

📊 Changes

7 files changed (+54 additions, -55 deletions)

View changed files

📝 docs/reference/https/haproxy.md (+10 -8)
📝 docs/reference/https/index.md (+10 -5)
📝 docs/reference/https/nginx.md (+13 -18)
📝 docs/reference/tab-nginx/LetsEncrypt.md (+2 -2)
📝 docs/reference/tab-nginx/NginxProxyManager.md (+15 -18)
📝 docs/reference/tab-nginx/SelfSigned.md (+2 -2)
📝 docs/reference/tab-nginx/Windows.md (+2 -2)

📄 Description

Summary

I compared the HTTPS overview, the Nginx, HAProxy and Nginx Proxy Manager pages and the Nginx tabs with the socket, cookie, forwarded-header and startup code.

CORS_ALLOW_ORIGIN defaults to *, so leaving it unset cannot break WebSocket. The three "must set it" warnings are now hardening tips that say what does break connections: a value that omits the public origin.
The web UI streams chat tokens over /ws/socket.io, not over the HTTP response, so proxy buffering cannot garble markdown in the browser. The directive stays, for API clients reading streamed responses.
The overview now names the Socket.IO path and that the browser uses the WebSocket transport only by default (ENABLE_WEBSOCKET_SUPPORT=false switches to long-polling). It adds forwarded headers and FORWARDED_ALLOW_IPS, the session and OAuth cookies that lack Secure by default, and the 25-second ping that makes 24-hour WebSocket timeouts unnecessary. It also adds the missing upload cap behind client_max_body_size, the /health and /ready endpoints, and WEBSOCKET_MANAGER=redis for several instances.
HAProxy: WebSocket does not need TLS, and the path method cannot work because there is no base path setting. X-CLIENT-IP is not read, and a /health check is added.
Nginx Proxy Manager: the field to fill is WebUI URL, not Webhook URL.

None.

Checklist

I have reviewed the relevant documentation and matched the existing style.
This PR meets Open WebUI's contribution standards: it is accurate, relevant to users, narrowly scoped, maintainable, and not promotional content, advertising, lead generation, SEO placement, or a request to list a product, service, provider, integration, gateway, tool, or company primarily for visibility.
I understand that PRs that do not meet these standards may be closed without review and will not be merged. Repeated, low-quality, off-topic, promotional, or intentionally misleading submissions may result in the contributor being blocked from future participation in Open WebUI repositories.

Notes for reviewers

Sources on dev: config.py (CORS_ALLOW_ORIGIN, RAG_FILE_MAX_SIZE), socket/main.py (path, transports, ping settings), src/routes/+layout.svelte (client transports), and main.py (/ws mount, /health, /ready, session cookie). Also backend/start.sh (--forwarded-allow-ips; open-webui serve trusts every peer instead, open_webui/__init__.py), env.py (cookie flags, ping intervals), routers/files.py (the HTTP 413 check), utils/oauth.py (request.base_url fallback), src/lib/constants.ts and svelte.config.js (no base path), and General.svelte for the WebUI URL field. Proxy product syntax is unchanged except where noted.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/docs/pull/1423 **Author:** [@silentoplayz](https://github.com/silentoplayz) **Created:** 9/18/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `docs/reverse-proxy-pages` --- ### 📝 Commits (1) - [`f2264fa`](https://github.com/open-webui/docs/commit/f2264fa81888df4714beaa5dc67ec2165a0dc45d) docs: correct the reverse proxy pages against the socket, cookie, forwarded-header and startup code ### 📊 Changes **7 files changed** (+54 additions, -55 deletions) <details> <summary>View changed files</summary> 📝 `docs/reference/https/haproxy.md` (+10 -8) 📝 `docs/reference/https/index.md` (+10 -5) 📝 `docs/reference/https/nginx.md` (+13 -18) 📝 `docs/reference/tab-nginx/LetsEncrypt.md` (+2 -2) 📝 `docs/reference/tab-nginx/NginxProxyManager.md` (+15 -18) 📝 `docs/reference/tab-nginx/SelfSigned.md` (+2 -2) 📝 `docs/reference/tab-nginx/Windows.md` (+2 -2) </details> ### 📄 Description ## Summary I compared the HTTPS overview, the Nginx, HAProxy and Nginx Proxy Manager pages and the Nginx tabs with the socket, cookie, forwarded-header and startup code. - `CORS_ALLOW_ORIGIN` defaults to `*`, so leaving it unset cannot break WebSocket. The three "must set it" warnings are now hardening tips that say what does break connections: a value that omits the public origin. - The web UI streams chat tokens over `/ws/socket.io`, not over the HTTP response, so proxy buffering cannot garble markdown in the browser. The directive stays, for API clients reading streamed responses. - The overview now names the Socket.IO path and that the browser uses the WebSocket transport only by default (`ENABLE_WEBSOCKET_SUPPORT=false` switches to long-polling). It adds forwarded headers and `FORWARDED_ALLOW_IPS`, the session and OAuth cookies that lack `Secure` by default, and the 25-second ping that makes 24-hour WebSocket timeouts unnecessary. It also adds the missing upload cap behind `client_max_body_size`, the `/health` and `/ready` endpoints, and `WEBSOCKET_MANAGER=redis` for several instances. - HAProxy: WebSocket does not need TLS, and the path method cannot work because there is no base path setting. `X-CLIENT-IP` is not read, and a `/health` check is added. - Nginx Proxy Manager: the field to fill is WebUI URL, not Webhook URL. ## Related issue or discussion None. ## Checklist - [x] I have reviewed the relevant documentation and matched the existing style. - [x] This PR meets Open WebUI's contribution standards: it is accurate, relevant to users, narrowly scoped, maintainable, and not promotional content, advertising, lead generation, SEO placement, or a request to list a product, service, provider, integration, gateway, tool, or company primarily for visibility. - [x] I understand that PRs that do not meet these standards may be closed without review and will not be merged. Repeated, low-quality, off-topic, promotional, or intentionally misleading submissions may result in the contributor being blocked from future participation in Open WebUI repositories. ## Notes for reviewers Sources on `dev`: `config.py` (`CORS_ALLOW_ORIGIN`, `RAG_FILE_MAX_SIZE`), `socket/main.py` (path, transports, ping settings), `src/routes/+layout.svelte` (client transports), and `main.py` (`/ws` mount, `/health`, `/ready`, session cookie). Also `backend/start.sh` (`--forwarded-allow-ips`; `open-webui serve` trusts every peer instead, `open_webui/__init__.py`), `env.py` (cookie flags, ping intervals), `routers/files.py` (the HTTP 413 check), `utils/oauth.py` (`request.base_url` fallback), `src/lib/constants.ts` and `svelte.config.js` (no base path), and `General.svelte` for the WebUI URL field. Proxy product syntax is unchanged except where noted. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-18 14:19:19 +00:00