[PR #175] fix: accept user_id query param on terminal WebSocket ownership check #150

New issue

Open

opened 2026-10-18 21:11:16 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 21:11:16 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-terminal/pull/175
Author: @SebastienTolron
Created: 9/17/2026
Status: 🔄 Open

Base: main ← Head: fix/ws-user-id-query-fallback

📝 Commits (1)

ec609a3 fix: accept user_id query param on terminal WebSocket ownership check

📊 Changes

1 file changed (+3 additions, -1 deletions)

View changed files

📝 open_terminal/main.py (+3 -1)

📄 Description

Fixes #169.

The ownership check added in f0edc9e reads the user only from the X-User-Id header. Open WebUI ≤ 0.11.3 sends it as ?user_id= on the WebSocket handshake and never as a header, so every terminal closes with 4004 Session not found.

This falls back to the query param when the header is absent. The header still wins when present; a mismatching or missing identity is still rejected.

Tested against a running server: 0.11.3-style handshake (query only) now attaches; header-style handshake still works; wrong user in query, wrong user in header with the victim's id in query, and no identity at all are all still closed with 4004.

Disclosure: this fix was written and tested with the help of Claude Fable 5.1 (via Claude Code). I reviewed the diff and the test results before submitting.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-terminal/pull/175 **Author:** [@SebastienTolron](https://github.com/SebastienTolron) **Created:** 9/17/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/ws-user-id-query-fallback` --- ### 📝 Commits (1) - [`ec609a3`](https://github.com/open-webui/open-terminal/commit/ec609a336196916eec2e81366797a9566938e07d) fix: accept user_id query param on terminal WebSocket ownership check ### 📊 Changes **1 file changed** (+3 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `open_terminal/main.py` (+3 -1) </details> ### 📄 Description Fixes #169. The ownership check added in f0edc9e reads the user only from the `X-User-Id` header. Open WebUI ≤ 0.11.3 sends it as `?user_id=` on the WebSocket handshake and never as a header, so every terminal closes with `4004 Session not found`. This falls back to the query param when the header is absent. The header still wins when present; a mismatching or missing identity is still rejected. Tested against a running server: 0.11.3-style handshake (query only) now attaches; header-style handshake still works; wrong user in query, wrong user in header with the victim's id in query, and no identity at all are all still closed with 4004. Disclosure: this fix was written and tested with the help of Claude Fable 5.1 (via Claude Code). I reviewed the diff and the test results before submitting. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-18 21:11:16 +00:00

No labels

bug

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

open-webui/open-terminal#150

No description provided.

Rows
Columns