langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 12:05:30 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

problems on CORS_ALLOW_ORIGINS #13249

New Issue
Closed
opened 2026-02-21 19:11:15 -05:00 by yindo · 2 comments
yindo commented 2026-02-21 19:11:15 -05:00
Owner
Copy Link
Copy Source

Originally created by @Wystan0608 on GitHub (Apr 23, 2025).

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.2

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

in .env, I have set
WEB_API_CORS_ALLOW_ORIGINS: ${WEB_API_CORS_ALLOW_ORIGINS:-}
CONSOLE_CORS_ALLOW_ORIGINS: ${CONSOLE_CORS_ALLOW_ORIGINS:-}

the problem of CORS stile there

Image

I created a floating page on a webpage to display the Dify frontend that I developed, and it calls the Dify API. The Dify and the frontend page are hosted on different servers and use different domains.

✔️ Expected Behavior

please tell me how to fix

❌ Actual Behavior

No response

Originally created by @Wystan0608 on GitHub (Apr 23, 2025). ### Self Checks - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [x] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:) - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.2 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce in .env, I have set WEB_API_CORS_ALLOW_ORIGINS: ${WEB_API_CORS_ALLOW_ORIGINS:-*} CONSOLE_CORS_ALLOW_ORIGINS: ${CONSOLE_CORS_ALLOW_ORIGINS:-*} the problem of CORS stile there ![Image](https://github.com/user-attachments/assets/2a25c540-bb45-4bb3-8157-f43a517f3bd5) I created a floating page on a webpage to display the Dify frontend that I developed, and it calls the Dify API. The Dify and the frontend page are hosted on different servers and use different domains. ### ✔️ Expected Behavior please tell me how to fix ### ❌ Actual Behavior _No response_
yindo closed this issue 2026-02-21 19:11:15 -05:00
yindo commented 2026-02-21 19:11:16 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Apr 23, 2025):

I found some similar threads that might help you resolve the CORS issue you're experiencing:

  1. CORS not working - This discussion is still open and might contain useful insights.
  2. How can I make the CORS works? - Another open discussion that could provide additional context or solutions.

To address the CORS error in your setup, ensure that the URLs specified in your docker-compose.yml file match your actual domains for the following:

  • CONSOLE_API_URL
  • CONSOLE_WEB_URL
  • SERVICE_API_URL
  • APP_API_URL
  • APP_WEB_URL

Even though you have set WEB_API_CORS_ALLOW_ORIGINS and CONSOLE_CORS_ALLOW_ORIGINS to allow all origins, it's crucial to verify these URL configurations. Additionally, check for any network issues or proxy settings that might be affecting the requests.

While using * to allow all origins is possible, it is not recommended due to security risks. Instead, specify the allowed domains explicitly in your environment variables like so:

CONSOLE_CORS_ALLOW_ORIGINS=https://example.com,https://anotherdomain.com
WEB_API_CORS_ALLOW_ORIGINS=https://example.com,https://anotherdomain.com

This approach ensures that only specified domains can access your Dify API resources, maintaining better security [1].

To continue talking to Dosu, mention @dosu.

Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other

@dosubot[bot] commented on GitHub (Apr 23, 2025): <!-- Answer --> I found some similar threads that might help you resolve the CORS issue you're experiencing: 1. [CORS not working](https://github.com/langgenius/dify/discussions/15274) - This discussion is still open and might contain useful insights. 2. [How can I make the CORS works?](https://github.com/langgenius/dify/discussions/10923) - Another open discussion that could provide additional context or solutions. To address the CORS error in your setup, ensure that the URLs specified in your `docker-compose.yml` file match your actual domains for the following: - `CONSOLE_API_URL` - `CONSOLE_WEB_URL` - `SERVICE_API_URL` - `APP_API_URL` - `APP_WEB_URL` Even though you have set `WEB_API_CORS_ALLOW_ORIGINS` and `CONSOLE_CORS_ALLOW_ORIGINS` to allow all origins, it's crucial to verify these URL configurations. Additionally, check for any network issues or proxy settings that might be affecting the requests. While using `*` to allow all origins is possible, it is not recommended due to security risks. Instead, specify the allowed domains explicitly in your environment variables like so: ``` CONSOLE_CORS_ALLOW_ORIGINS=https://example.com,https://anotherdomain.com WEB_API_CORS_ALLOW_ORIGINS=https://example.com,https://anotherdomain.com ``` This approach ensures that only specified domains can access your Dify API resources, maintaining better security <sup>[[1]](https://github.com/langgenius/dify/issues/12866)</sup>. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.* --- <sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/37730618-664d-4e2b-beee-bf1dfcc66773?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/37730618-664d-4e2b-beee-bf1dfcc66773?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/37730618-664d-4e2b-beee-bf1dfcc66773?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/37730618-664d-4e2b-beee-bf1dfcc66773?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/37730618-664d-4e2b-beee-bf1dfcc66773?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/37730618-664d-4e2b-beee-bf1dfcc66773?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/37730618-664d-4e2b-beee-bf1dfcc66773?feedback_type=other)</sup>
yindo commented 2026-02-21 19:11:16 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Apr 23, 2025):

We do not provide technical support for starting from the source. Thank you for your understanding. We assume you have the necessary expertise to set it up independently. If you require technical support, please obtain our business license by contacting us at business@dify.ai.

@crazywoola commented on GitHub (Apr 23, 2025): We do not provide technical support for starting from the source. Thank you for your understanding. We assume you have the necessary expertise to set it up independently. If you require technical support, please obtain our business license by contacting us at business@dify.ai.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#13249
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?