Skip to content
PR Quorum
Sign inStart free
← Review gallery
open-webui/open-webui #27186openreviewed 5h ago

feat: forward chat_id as user field in OpenAI-compatible chat completions

by ekinnee+183 04 filesreviewed in 1m 37sView PR on GitHub
needs attentionThe panel surfaced issues that deserve attention before merge.2 findings · 1 high+

Reviewer panel

Correctness
deepseek/deepseek-v4-pro
1 found
Security
deepseek/deepseek-v4-pro
0 found
Architecture
deepseek/deepseek-v4-pro
1 found

Findings

01Hhighconf 95%

Crash when metadata is not a dict

backend/open_webui/routers/openai.py

The helper _inject_chat_id_as_user calls metadata.get('chat_id') without checking that metadata is a dict. If a client sends a non-dict value for metadata (e.g. an empty list [], a string, a number), metadata.get(...) raises AttributeError, resulting in a 500 error. The condition only uses truthiness (if metadata), which passes for non-empty lists and other truthy non-dict objects. This introduces a new crash path compared to the previous code that just popped and ignored metadata.

Suggested fix

if ENABLE_FORWARD_CHAT_ID and isinstance(metadata, dict) and metadata.get('chat_id') and 'user' not in payload:

02Llowconf 95%

Module-level flag read prevents runtime toggling

backend/open_webui/routers/openai.py:1213

_inject_chat_id_as_user reads ENABLE_FORWARD_CHAT_ID from the module's import-time snapshot rather than from env.py on every call. This means _inject_chat_id_as_user will never observe a runtime change to the environment variable — it behaves as a static constant. While this matches the default-deferred resolution pattern used elsewhere in this codebase (e.g., ENABLE_FORWARD_USER_INFO_HEADERS), it breaks unit-test isolation: the test suite monkeypatches the router module instead of the source-of-truth env module, creating a divergence between test behavior and production. The pattern is fragile; future maintainers may re-import and lose the monkeypatch. Consider reading the env variable lazily inside the helper or during request processing so that runtime changes are reflected and tests can set the environment directly without patching module state.

Want this on your own pull requests?
The same reviewer panel runs on every PR — one focused review, no noise.
Start freeLive demo