From 3761aadc41512f1278652c038a54cb749763ceb2 Mon Sep 17 00:00:00 2001 From: Greg DeYoung Date: Wed, 24 Jun 2026 11:02:24 -0400 Subject: [PATCH] fix: persist generated FLASK_SECRET_KEY to .env When FLASK_SECRET_KEY is not set, the server generates a random key on every restart. This invalidates all browser session cookies, causing API/WebSocket requests to redirect to /login (HTML) instead of returning JSON. The frontend then fails with 'Unexpected token <'. Fix: auto-generate and persist the key to usr/.env using the existing dotenv.save_dotenv_value() helper, so sessions survive restarts. --- helpers/ui_server.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/helpers/ui_server.py b/helpers/ui_server.py index cbf14a0543..497c06fc16 100644 --- a/helpers/ui_server.py +++ b/helpers/ui_server.py @@ -74,7 +74,11 @@ class UiServerRuntime: @classmethod def create(cls) -> "UiServerRuntime": webapp = Flask("app", static_folder=get_abs_path("./webui"), static_url_path="/") - webapp.secret_key = os.getenv("FLASK_SECRET_KEY") or secrets.token_hex(32) + flask_secret_key = os.getenv("FLASK_SECRET_KEY") + if not flask_secret_key: + flask_secret_key = secrets.token_hex(32) + dotenv.save_dotenv_value("FLASK_SECRET_KEY", flask_secret_key) + webapp.secret_key = flask_secret_key WerkzeugRequest.max_form_memory_size = UPLOAD_LIMIT_BYTES webapp.config.update(