From e473ab1231abedcb188c259b42ae7f2390739223 Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Wed, 17 Jun 2026 03:01:11 +0200
Subject: [PATCH] refac

---
 backend/open_webui/__init__.py | 6 +++++-
 backend/start.sh               | 9 +++++++--
 backend/start_windows.bat      | 5 ++++-
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/backend/open_webui/__init__.py b/backend/open_webui/__init__.py
index 92cadefe7c..59817d7921 100644
--- a/backend/open_webui/__init__.py
+++ b/backend/open_webui/__init__.py
@@ -11,6 +11,7 @@ import uvicorn
 app = typer.Typer()
 
 KEY_FILE = Path.cwd() / '.webui_secret_key'
+DEFAULT_SECRET_KEY_LENGTH = 24
 
 
 def version_callback(value: bool) -> None:
@@ -37,8 +38,11 @@ def serve(
     if os.getenv('WEBUI_SECRET_KEY') is None:
         typer.echo('Loading WEBUI_SECRET_KEY from file, not provided as an environment variable.')
         if not KEY_FILE.exists():
+            key_length = int(os.getenv('WEBUI_SECRET_KEY_LENGTH', DEFAULT_SECRET_KEY_LENGTH))
+            if key_length < 1:
+                raise ValueError('WEBUI_SECRET_KEY_LENGTH must be a positive integer')
             typer.echo(f'Generating a new secret key and saving it to {KEY_FILE}')
-            KEY_FILE.write_bytes(base64.b64encode(random.randbytes(12)))
+            KEY_FILE.write_bytes(base64.b64encode(random.randbytes(key_length)))
         typer.echo(f'Loading WEBUI_SECRET_KEY from {KEY_FILE}')
         os.environ['WEBUI_SECRET_KEY'] = KEY_FILE.read_text()
 
diff --git a/backend/start.sh b/backend/start.sh
index 9e65465095..0846273b89 100755
--- a/backend/start.sh
+++ b/backend/start.sh
@@ -30,6 +30,7 @@ fi
 # ── Secret key setup ─────────────────────────────────────────────────────────
 
 KEY_FILE="${WEBUI_SECRET_KEY_FILE:-.webui_secret_key}"
+WEBUI_SECRET_KEY_LENGTH="${WEBUI_SECRET_KEY_LENGTH:-24}"
 PORT="${PORT:-8080}"
 HOST="${HOST:-0.0.0.0}"
 
@@ -38,7 +39,11 @@ if [[ -z "${WEBUI_SECRET_KEY:-}" && -z "${WEBUI_JWT_SECRET_KEY:-}" ]]; then
 
   if [[ ! -f "$KEY_FILE" ]]; then
     echo "Generating new WEBUI_SECRET_KEY..."
-    head -c 12 /dev/random | base64 > "$KEY_FILE"
+    if ! [[ "$WEBUI_SECRET_KEY_LENGTH" =~ ^[1-9][0-9]*$ ]]; then
+      echo "WEBUI_SECRET_KEY_LENGTH must be a positive integer." >&2
+      exit 1
+    fi
+    head -c "$WEBUI_SECRET_KEY_LENGTH" /dev/random | base64 > "$KEY_FILE"
   fi
 
   echo "Loading WEBUI_SECRET_KEY from ${KEY_FILE}"
@@ -105,4 +110,4 @@ exec env WEBUI_SECRET_KEY="${WEBUI_SECRET_KEY:-}" \
     --host "$HOST" \
     --port "$PORT" \
     --forwarded-allow-ips "${FORWARDED_ALLOW_IPS:-*}" \
-    "${ARGS[@]}"
\ No newline at end of file
+    "${ARGS[@]}"
diff --git a/backend/start_windows.bat b/backend/start_windows.bat
index c5f96e0e6f..b86beb11e8 100644
--- a/backend/start_windows.bat
+++ b/backend/start_windows.bat
@@ -27,6 +27,9 @@ IF "%HOST%"=="" SET HOST=0.0.0.0
 IF "%FORWARDED_ALLOW_IPS%"=="" SET "FORWARDED_ALLOW_IPS='*'"
 SET "WEBUI_SECRET_KEY=%WEBUI_SECRET_KEY%"
 SET "WEBUI_JWT_SECRET_KEY=%WEBUI_JWT_SECRET_KEY%"
+IF "%WEBUI_SECRET_KEY_LENGTH%" == "" (
+    SET "WEBUI_SECRET_KEY_LENGTH=24"
+)
 
 :: Check if WEBUI_SECRET_KEY and WEBUI_JWT_SECRET_KEY are not set
 IF "%WEBUI_SECRET_KEY% %WEBUI_JWT_SECRET_KEY%" == " " (
@@ -36,7 +39,7 @@ IF "%WEBUI_SECRET_KEY% %WEBUI_JWT_SECRET_KEY%" == " " (
         echo Generating WEBUI_SECRET_KEY
         :: Generate a random value to use as a WEBUI_SECRET_KEY in case the user didn't provide one
         SET /p WEBUI_SECRET_KEY=<nul
-        FOR /L %%i IN (1,1,12) DO SET /p WEBUI_SECRET_KEY=<!random!>>%KEY_FILE%
+        FOR /L %%i IN (1,1,%WEBUI_SECRET_KEY_LENGTH%) DO SET /p WEBUI_SECRET_KEY=<!random!>>%KEY_FILE%
         echo WEBUI_SECRET_KEY generated
     )