mirror of
https://github.com/langgenius/dify-official-plugins.git
synced 2026-07-21 17:45:23 -04:00
Unable to connect to Huawei ModelArts from private infrastructure #634
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @xzneozx96 on GitHub (Sep 10, 2025).
Self Checks
Dify version
1.6.0
Cloud or Self Hosted
Self Hosted (Source)
Steps to reproduce
Hi Team,
We’re experiencing issues connecting to the ModelArts LLM from our private Huawei-provided infrastructure. From our investigation, this seems related to our custom integration rather than ModelArts itself.
Step to reproduce:
Currently, when attempting to connect, we encounter an error. The Huawei team suggested bypassing it by using the following approach:
request.post(url, json=data, headers=headers, timeout=360, **verify=False**The challenge is that we’re unsure where in our codebase this change should be applied. Could you please advise us on the correct way to implement this fix?
✔️ Expected Behavior
Able to bypass the SSL error with custom code snippet
❌ Actual Behavior
No response
@xzneozx96 commented on GitHub (Sep 11, 2025):
hi @dosubot, can you help with this?
@dosubot[bot] commented on GitHub (Sep 11, 2025):
To bypass the SSL verification error for Huawei ModelArts in your Dify setup, you should edit the Huawei Cloud MASS plugin code—specifically, the
HuaWeiCloudMaaSModel.invokemethod inmodels/huaweicloud_maas/models/llm/model.py. In therequests.postcall that sends requests to ModelArts, add the parameterverify=False. This will disable SSL certificate checks for these requests only.Example:
Important: Disabling SSL verification exposes you to security risks like man-in-the-middle attacks and data leaks. Only use this workaround in trusted, private environments—not in production. If possible, consider installing the correct CA certificates or using
http://instead ofhttps://for testing, though this may not be supported by ModelArts. For more on the risks and best practices, see this discussion.If you update the plugin code, restart your services to apply the change. If you still see errors, double-check the plugin version and confirm the edit is in the right place.
To reply, just mention @dosu.
How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other
@xzneozx96 commented on GitHub (Sep 11, 2025):
can not find any logic like this from the HuaweiCloud Mass Plugin, seem it's abstracted away @dosubot
@dosubot[bot] commented on GitHub (Sep 11, 2025):
You're right—the HuaweiCloud MASS plugin doesn't expose direct HTTP request logic like
requests.postin its code. Instead, it relies on a shared library (dify_plugin) that abstracts HTTP calls, likely usinghttpxunder the hood. This means you can't simply addverify=Falsein the plugin code itself.Currently, the Dify platform does not support disabling SSL verification for outbound requests at the plugin or platform level for security reasons, and this option isn't exposed in the plugin's configuration or credential schema. Any change to SSL verification would require modifying the shared library or monkey-patching the HTTP client at runtime, which is not recommended for production use due to security risks (source).
As a workaround, some users have solved SSL verification problems by setting a custom CA file in the plugin daemon container's certifi module path, but this isn't always possible for compressed or compiled plugin packages (source). If you need to bypass SSL verification for testing, you would need to patch the shared HTTP client or adjust the environment to trust the certificate, but there is no simple config or code change in the plugin itself.
Let me know if you want details on patching
httpxor setting up custom CA certificates for your environment.To reply, just mention @dosu.
How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other
@xzneozx96 commented on GitHub (Sep 11, 2025):
pls give me solution on patching httpx @dosubot
@dosubot[bot] commented on GitHub (Sep 11, 2025):
To patch httpx and disable SSL verification for all outbound requests in your plugin environment, you need to modify the shared HTTP client logic. Since the HuaweiCloud MASS plugin uses an abstracted HTTP layer, the most effective approach is to patch the httpx client at the shared utility level.
One method is to override the default HTTPS context globally in Python. For example, you can add this at the very top of your plugin's entrypoint (before any HTTP requests are made):
This disables SSL verification for all HTTPS requests in Python, including those made by httpx, as long as httpx uses the default SSL context. This approach is used in other plugins (like Azure AI Studio) to bypass SSL verification for testing or in trusted environments.
Warning: Disabling SSL verification exposes you to security risks (e.g., man-in-the-middle attacks). Only use this in isolated, trusted environments.
If you want to patch httpx more specifically, you would need to locate where the httpx.Client or httpx.AsyncClient is instantiated in the shared dify_plugin code (often in a file like
api/core/helper/ssrf_proxy.py), and setverify=Falsein the client or transport initialization. This change will cascade to all outbound requests using that client.After making the change, restart your plugin daemon or container to apply it.
There are no environment variables or config options to control SSL verification globally for plugins—code-level patching is required for this use case. For more details, see this example.
To reply, just mention @dosu.
How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other
