refac

backend/open_webui/retrieval/loaders/mistral.py

@@ -9,7 +9,7 @@ from typing import List, Dict, Any
 from contextlib import asynccontextmanager
 
 from langchain_core.documents import Document
-from open_webui.env import GLOBAL_LOG_LEVEL
+from open_webui.env import GLOBAL_LOG_LEVEL, AIOHTTP_CLIENT_SESSION_SSL
 
 logging.basicConfig(stream=sys.stdout, level=GLOBAL_LOG_LEVEL)
 log = logging.getLogger(__name__)
@@ -285,6 +285,7 @@ class MistralLoader:
                 data=writer,
                 headers=self.headers,
                 timeout=aiohttp.ClientTimeout(total=self.upload_timeout),
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
             ) as response:
                 return await self._handle_response_async(response)
 
@@ -333,6 +334,7 @@ class MistralLoader:
                 headers=headers,
                 params=params,
                 timeout=aiohttp.ClientTimeout(total=self.url_timeout),
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
             ) as response:
                 return await self._handle_response_async(response)
 
@@ -404,6 +406,7 @@ class MistralLoader:
                 json=payload,
                 headers=headers,
                 timeout=aiohttp.ClientTimeout(total=self.ocr_timeout),
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
             ) as response:
                 ocr_response = await self._handle_response_async(response)
 
@@ -436,7 +439,8 @@ class MistralLoader:
                 async with session.delete(
                     url=f'{self.base_url}/files/{file_id}',
                     headers=self.headers,
-                    timeout=aiohttp.ClientTimeout(total=self.cleanup_timeout),  # Shorter timeout for cleanup
+                    timeout=aiohttp.ClientTimeout(total=self.cleanup_timeout),
+                    ssl=AIOHTTP_CLIENT_SESSION_SSL,
                 ) as response:
                     return await self._handle_response_async(response)
 

backend/open_webui/retrieval/web/utils.py

@@ -45,6 +45,7 @@ from open_webui.config import (
     WEB_FETCH_FILTER_LIST,
 )
 from open_webui.utils.misc import is_string_allowed
+from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL
 
 log = logging.getLogger(__name__)
 
@@ -511,6 +512,8 @@ class SafeWebBaseLoader(WebBaseLoader):
                     )
                     if not self.session.verify:
                         kwargs['ssl'] = False
+                    else:
+                        kwargs['ssl'] = AIOHTTP_CLIENT_SESSION_SSL
 
                     async with session.get(
                         url,

backend/open_webui/routers/audio.py

@@ -1304,6 +1304,7 @@ async def get_available_models(request: Request) -> list[dict]:
                 try:
                     async with session.get(
                         f'{request.app.state.config.TTS_OPENAI_API_BASE_URL}/audio/models',
+                        ssl=AIOHTTP_CLIENT_SESSION_SSL,
                     ) as response:
                         response.raise_for_status()
                         data = await response.json()
@@ -1315,6 +1316,7 @@ async def get_available_models(request: Request) -> list[dict]:
                     try:
                         async with session.get(
                             f'{request.app.state.config.TTS_OPENAI_API_BASE_URL}/models',
+                            ssl=AIOHTTP_CLIENT_SESSION_SSL,
                         ) as response:
                             response.raise_for_status()
                             data = await response.json()
@@ -1335,6 +1337,7 @@ async def get_available_models(request: Request) -> list[dict]:
                         'xi-api-key': request.app.state.config.TTS_API_KEY,
                         'Content-Type': 'application/json',
                     },
+                    ssl=AIOHTTP_CLIENT_SESSION_SSL,
                 ) as response:
                     response.raise_for_status()
                     models = await response.json()
@@ -1362,6 +1365,7 @@ async def get_available_voices(request) -> dict:
                 async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
                     async with session.get(
                         f'{request.app.state.config.TTS_OPENAI_API_BASE_URL}/audio/voices',
+                        ssl=AIOHTTP_CLIENT_SESSION_SSL,
                     ) as response:
                         response.raise_for_status()
                         data = await response.json()
@@ -1401,7 +1405,7 @@ async def get_available_voices(request) -> dict:
 
             timeout = aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT_MODEL_LIST)
             async with aiohttp.ClientSession(timeout=timeout, trust_env=True) as session:
-                async with session.get(url, headers=headers) as response:
+                async with session.get(url, headers=headers, ssl=AIOHTTP_CLIENT_SESSION_SSL) as response:
                     response.raise_for_status()
                     voices = await response.json()
 
@@ -1422,6 +1426,7 @@ async def get_available_voices(request) -> dict:
                         headers={
                             'Authorization': f'Bearer {api_key}',
                         },
+                        ssl=AIOHTTP_CLIENT_SESSION_SSL,
                     ) as response:
                         response.raise_for_status()
                         voices_data = await response.json()
@@ -1456,6 +1461,7 @@ async def get_elevenlabs_voices(api_key: str) -> dict:
                     'xi-api-key': api_key,
                     'Content-Type': 'application/json',
                 },
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
             ) as response:
                 response.raise_for_status()
                 voices_data = await response.json()

backend/open_webui/routers/auths.py

@@ -810,7 +810,7 @@ async def signout(request: Request, response: Response, db: AsyncSession = Depen
             oauth_id_token = session.token.get('id_token')
             try:
                 async with ClientSession(trust_env=True) as session:
-                    async with session.get(oauth_server_metadata_url) as r:
+                    async with session.get(oauth_server_metadata_url, ssl=AIOHTTP_CLIENT_SESSION_SSL) as r:
                         if r.status == 200:
                             openid_data = await r.json()
                             logout_url = openid_data.get('end_session_endpoint')

backend/open_webui/routers/configs.py

@@ -6,7 +6,7 @@ import aiohttp
 
 from typing import Optional
 
-from open_webui.env import AIOHTTP_CLIENT_TIMEOUT
+from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL, AIOHTTP_CLIENT_TIMEOUT
 from open_webui.utils.auth import get_admin_user, get_verified_user
 from open_webui.config import get_config, save_config, async_save_config
 from open_webui.config import BannerModel
@@ -293,7 +293,7 @@ async def verify_terminal_server_connection(
         ) as session:
             # Orchestrators expose a policies API; plain terminals don't.
             try:
-                async with session.get(f'{base_url}/api/v1/policies', headers=headers) as resp:
+                async with session.get(f'{base_url}/api/v1/policies', headers=headers, ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp:
                     if resp.ok:
                         return {'status': True, 'type': 'orchestrator'}
             except Exception:
@@ -301,7 +301,7 @@ async def verify_terminal_server_connection(
 
             # Fall back to open-terminal config endpoint.
             try:
-                async with session.get(f'{base_url}/api/config', headers=headers) as resp:
+                async with session.get(f'{base_url}/api/config', headers=headers, ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp:
                     if resp.ok:
                         return {'status': True, 'type': 'terminal'}
             except Exception:
@@ -342,7 +342,7 @@ async def put_terminal_server_policy(
             timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT),
         ) as session:
             policy_url = f'{base_url}/api/v1/policies/{form_data.policy_id}'
-            async with session.put(policy_url, headers=headers, json=form_data.policy_data) as resp:
+            async with session.put(policy_url, headers=headers, json=form_data.policy_data, ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp:
                 if resp.ok:
                     return await resp.json()
                 detail = await resp.text()
@@ -369,7 +369,7 @@ async def verify_tool_servers_config(request: Request, form_data: ToolServerConn
                         trust_env=True,
                         timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT),
                     ) as session:
-                        async with session.get(discovery_url) as oauth_server_metadata_response:
+                        async with session.get(discovery_url, ssl=AIOHTTP_CLIENT_SESSION_SSL) as oauth_server_metadata_response:
                             if oauth_server_metadata_response.status == 200:
                                 try:
                                     oauth_server_metadata = OAuthMetadata.model_validate(

backend/open_webui/utils/automations.py

@@ -272,6 +272,7 @@ async def _set_terminal_cwd(app, server_id: str, user, cwd: str, chat_id: str) -
     handled correctly — same path the frontend uses.
     """
     import aiohttp
+    from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL
 
     connections = getattr(getattr(app, 'state', None), 'config', None)
     if connections is None:
@@ -307,6 +308,7 @@ async def _set_terminal_cwd(app, server_id: str, user, cwd: str, chat_id: str) -
                 target_url,
                 json={'path': cwd},
                 headers=headers,
+                ssl=AIOHTTP_CLIENT_SESSION_SSL,
             ) as resp:
                 if resp.status != 200:
                     body = await resp.text()

backend/open_webui/utils/tools.py

@@ -44,6 +44,7 @@ from open_webui.utils.plugin import load_tool_module_by_id
 from open_webui.utils.access_control import has_access, has_connection_access
 from open_webui.config import BYPASS_ADMIN_ACCESS_CONTROL
 from open_webui.env import (
+    AIOHTTP_CLIENT_SESSION_SSL,
     AIOHTTP_CLIENT_TIMEOUT,
     AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER,
     AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER_DATA,
@@ -907,7 +908,7 @@ async def get_terminal_cwd(
             timeout=aiohttp.ClientTimeout(total=5),
             trust_env=True,
         ) as session:
-            async with session.get(cwd_url, headers=headers, cookies=cookies or {}) as resp:
+            async with session.get(cwd_url, headers=headers, cookies=cookies or {}, ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp:
                 if resp.status == 200:
                     data = await resp.json()
                     return data.get('cwd')
@@ -934,7 +935,7 @@ async def get_terminal_system_prompt(
             trust_env=True,
         ) as session:
             # 1. Check feature flag
-            async with session.get(f'{base}/api/config') as resp:
+            async with session.get(f'{base}/api/config', ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp:
                 if resp.status != 200:
                     return None
                 config = await resp.json()
@@ -942,7 +943,7 @@ async def get_terminal_system_prompt(
                     return None
 
             # 2. Fetch system prompt
-            async with session.get(f'{base}/system', headers=headers, cookies=cookies or {}) as resp:
+            async with session.get(f'{base}/system', headers=headers, cookies=cookies or {}, ssl=AIOHTTP_CLIENT_SESSION_SSL) as resp:
                 if resp.status == 200:
                     data = await resp.json()
                     return data.get('prompt')

backend/open_webui/utils/webhook.py

@@ -3,7 +3,7 @@ import logging
 import aiohttp
 
 from open_webui.config import WEBUI_FAVICON_URL
-from open_webui.env import AIOHTTP_CLIENT_TIMEOUT, VERSION
+from open_webui.env import AIOHTTP_CLIENT_SESSION_SSL, AIOHTTP_CLIENT_TIMEOUT, VERSION
 
 log = logging.getLogger(__name__)
 
@@ -53,7 +53,7 @@ async def post_webhook(name: str, url: str, message: str, event_data: dict) -> b
         async with aiohttp.ClientSession(
             trust_env=True, timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT)
         ) as session:
-            async with session.post(url, json=payload) as r:
+            async with session.post(url, json=payload, ssl=AIOHTTP_CLIENT_SESSION_SSL) as r:
                 r_text = await r.text()
                 r.raise_for_status()
                 log.debug(f'r.text: {r_text}')