From 443736e1fea3f5549b11b3bfda9dfa41cb621e1b Mon Sep 17 00:00:00 2001 From: Classic298 <27028174+Classic298@users.noreply.github.com> Date: Thu, 24 Sep 2026 05:36:26 +0200 Subject: [PATCH] refactor: use secrets module for generated secret key (#30441) Generates the default WEBUI_SECRET_KEY file with secrets.token_bytes, matching how the start scripts read from the OS random source. --- backend/open_webui/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/open_webui/__init__.py b/backend/open_webui/__init__.py index e803cea466..c56c875566 100644 --- a/backend/open_webui/__init__.py +++ b/backend/open_webui/__init__.py @@ -1,6 +1,6 @@ import base64 import os -import random +import secrets import sys from pathlib import Path from typing import Annotated @@ -45,7 +45,7 @@ def serve( if key_length < 1: raise ValueError('WEBUI_SECRET_KEY_LENGTH must be a positive integer') typer.echo(f'Generating a new secret key and saving it to {KEY_FILE}') - KEY_FILE.write_bytes(base64.b64encode(random.randbytes(key_length))) + KEY_FILE.write_bytes(base64.b64encode(secrets.token_bytes(key_length))) typer.echo(f'Loading WEBUI_SECRET_KEY from {KEY_FILE}') os.environ['WEBUI_SECRET_KEY'] = KEY_FILE.read_text()