How Does Having An Account With OpenWebUI Improve Security as the FAQ Says?

[richardstevenhack]

This doesn't make any sense to me, and I know of no other AI front end using local LLM models requiring an account signup.

If this system is entirely locally installed and all data is on my system, how can "the Open WebUI...ever exposed to external access" (and what does that mean - exposed on the Internet, or exposed locally?) be affected by my having an account on your Web site?

Until that question is answered, I have to be suspicious about the claim that everything in the system remains on my system and I can't use this tool until it is explained to me.

[justinh-rahb]

There are many alternative interfaces available to choose from.

[richardstevenhack]

Yes, and I'm using them. But I'd like to compare them with this one. Vague comments about security don't inspire confidence.

[justinh-rahb]

And people that grumble about things that are easily verified probably wouldn't be satisfied by anything we have to say, so why bother?

Accounts are local, your personal information is not being collected. If you don't trust me then you can read the code or inspect your network traffic with Wireshark.

[richardstevenhack]

OK, it's clear now that Open-WebUI is full of shit. I'll use something else, thanks.

[tjbck]

🚀🚀

[justinh-rahb]

If you're going to whine about the supposed insecurity of an open-source project, at least have the decency to educate yourself first. Open-source means anyone can inspect the code, so if you lack the basic skills to verify the security claims made by others, it literally does not matter what I say. Don't spread FUD (fear, uncertainty, and doubt) without doing your damn homework.

Learn how to read and understand the code, or keep your unsubstantiated opinions to yourself. The open-source community doesn't need more armchair critics.

[richardstevenhack]

Let's not be stupid here. The average end user is not going to "inspect the code".

I asked a simple question: Why does having an account on a Web site affect the security of the app running locally on my machine? And why would somehow exposing that app to the Internet have its security improved by having an account on the app's Web site?

It's a legitimate simple question deserving of a simple answer. Instead people got snippy about it and refused to answer the simple question, which would have taken two minutes.

I DO know something about computer security. That's why I get suspicious when someone tells me something that makes no sense. In my view, the requirement of an account is probably being used for personal information collection and potentially sale to Internet ad firms.

I'd have no problem signing up for an account if it wasn't required to run the app in the first place and there was some additional benefit such as support or whatever. But when someone won't answer the question, that makes me suspicious that there are ulterior motives.

What the open source community does need is less snippy developers who take umbrage at simple questions.

[tjbck]

It's not required. Check our front page of docs. Best of luck to you.

[richardstevenhack]

Now how hard was that to say?

I missed the "If you want to disable login for a single-user setup, set WEBUI_AUTH to False. This will bypass the login page." part.

Right now I can't even remember if I installed it via Docker or the pip command. If it was the latter, I probably skipped over that part of the docs and went to the manual installation part because I hate Docker for this stuff. I just spent several days debugging Docker with Lobe Chat and RAGapp and AnythingLLM, so I'm not partial to Docker, but I love pipx.

Thank you for the explanation. I'll try open-webUI again.

[richardstevenhack]

OK, tried the pipx install. That installed but when I ran it, it asked for the login, so I exported the WEBUI_AUTH environment variable to false, and ran it again. This time it just set a spinner running and generated a massive amount of python tracebacks in the terminal.

So I decided to try the Docker version. I used this command line first:
docker run -d -p 3000:8080 --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main

What happened there is that the http://localhost:3000/auth came up but does not appear to acknowledge the WEBUI_AUTH environment variable, as it continues to ask for a login.

Then following your troubleshooting advice page (which incidentally enabled me to solve my problems with two other Ollama front-end Docker connections), I tried this command:

docker run -d --network=host -v open-webui:/app/backend/data -e OLLAMA_BASE_URL=http://127.0.0.1:11434 --name open-webui --restart always ghcr.io/open-webui/open-webui:main

That didn't work, either. When I went to localhost:8080, I saw a page that appeared to have a "OI" on it. I have no idea what that was. UPDATE: Ah, figured out what that was: it's the OI that appears in the upper left hand corner of the page on the signin page. However in this case it was larger and in the middle of the page. But there was no signin option shown. That seems weird.

Any help would be appreciated.

[richardstevenhack]

Tried one more time as I had the WEBUI_AUTH set to lower case "false" rather than "False". No change. It still seems to be ignoring the environment variable.

[ricky-davis]

You are fundamentally misunderstanding the FAQ.
Open-WebUI is a locally hosted multi-user tool, which means you have to make user accounts... locally.
"We require you to sign up to become the admin user for enhanced security." Means you are signing up for an account on your local instance of open-webui, not on the open-webui community site. Making an account on your locally hosted instance improves security... by requiring a login to perform administrative duties on your local instance. Disabling accounts means anybody inside your network (or externally if you port forward or otherwise expose your webserver somehow) can hit your server's IP:Port and will just magically gain administrative functionality.

[richardstevenhack]

OK, the hell with it. I signed up for an account and now everything works. Using the second form of Docker command with the --network=host and the Ollama BASE_URL works with Ollama.

That explanation was all I asked for in the first place. Fortunately everything is understood and working now. I can now compare this UI with the half dozen others I'm testing out.

[justinh-rahb]

@richardstevenhack,

News flash: No one owes you a simple answer, especially when you approach the community with an attitude. Open-source developers are volunteers who dedicate their time and energy to creating something for the benefit of others. When you demand answers and act like a know-it-all, don't be surprised if people push back or ignore you.

It's great that you eventually figured out the issue and got everything working. But your journey could have been smoother if you'd approached the community with humility and respect from the start. Open-source communities thrive on constructive feedback and contributions, not armchair criticism and self-proclaimed expertise.

So, next time, leave your ego at the door and remember that you're part of a community. We're all here to help each other and make open-source projects better. Your initial attitude didn't reflect that, and it's something you should work on if you want to be a valued member of any open-source project.

[richardstevenhack]

I'll add two more pieces of advice since people here seem to want to insult me...

I figured out where I went wrong - it's the crappy UI.

1. Instead of warning people that they can't change from single to multiuser mode in the docs - which no one RTFM - that should be stated on the initial sign-in page. Something like: "Is this for a single user or a multi-user system? Pick one."

2. The real problem is the terminology used on the sign in page. It SOUNDS like a Web site signup, not a multiuser server account creation. Instead of talking about "sign-in" and worse "sign up" - which is not what the user is doing - the terms should be something along the lines of "login to local server" or "create local user account". Every single other utility of this type uses that language. This US sounds like a Web site signup. This is a Web APP, not a Web SITE.

GUI design matters. Get it wrong, it confuses the end user. That is precisely why I jumped the shark on why that sign-in page made me think it was asking for a Web account, not a local account. And the FAQ doesn't distinguish the term "account" either.

Kindly close this as I don't need to hear from any more self-righteous assholes telling me how I should "worship open source developers" - they're no damn better than any other developer. They just get paid less.