langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 20:15:31 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Images with external URLs (e.g. img2024.cnblogs.com) return 403 Forbidden in bot replies #14570

New Issue
Closed
opened 2026-02-21 19:17:50 -05:00 by yindo · 2 comments
yindo commented 2026-02-21 19:17:50 -05:00
Owner
Copy Link
Copy Source

Originally created by @fumiadder on GitHub (Jun 12, 2025).

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.4.0

Cloud or Self Hosted

Self Hosted (Source)

Steps to reproduce

Hi team,

I'm currently using Dify to build a knowledge-based assistant. Some Markdown documents in my knowledge base include images from external sources, such as:

However, when the bot replies with Markdown that includes these images, the images fail to load, and I get a 403 Forbidden error in the browser console. See screenshot:
Image

✔️ Expected Behavior

Images hosted on public URLs should be loaded correctly in bot replies (Markdown rendering).

Alternatively, allow image rendering via a proxy or configurable referrer.

❌ Actual Behavior

External images from domains with hotlinking protection (like img2024.cnblogs.com) return 403 errors.

This happens even though the URL is valid and opens fine in a new browser tab.

Originally created by @fumiadder on GitHub (Jun 12, 2025). ### Self Checks - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [x] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:) - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.4.0 ### Cloud or Self Hosted Self Hosted (Source) ### Steps to reproduce Hi team, I'm currently using Dify to build a knowledge-based assistant. Some Markdown documents in my knowledge base include images from external sources, such as: ![](https://img2024.cnblogs.com/other/2867340/202506/2867340-20250612105205515-1820418022.png) However, when the bot replies with Markdown that includes these images, the images fail to load, and I get a 403 Forbidden error in the browser console. See screenshot: ![Image](https://github.com/user-attachments/assets/6597b000-8c2a-4c5e-84a5-041b26cc9540) ### ✔️ Expected Behavior Images hosted on public URLs should be loaded correctly in bot replies (Markdown rendering). Alternatively, allow image rendering via a proxy or configurable referrer. ### ❌ Actual Behavior External images from domains with hotlinking protection (like img2024.cnblogs.com) return 403 errors. This happens even though the URL is valid and opens fine in a new browser tab.
yindo closed this issue 2026-02-21 19:17:51 -05:00
yindo commented 2026-02-21 19:17:51 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Jun 14, 2025):

You can edit this.

https://github.com/langgenius/dify/blob/8cb3ed5cc2d51ddb391dfc80cdc96d2b71556d3a/docker/.env.example#L1014-L1015

@crazywoola commented on GitHub (Jun 14, 2025): You can edit this. https://github.com/langgenius/dify/blob/8cb3ed5cc2d51ddb391dfc80cdc96d2b71556d3a/docker/.env.example#L1014-L1015
yindo commented 2026-02-21 19:17:51 -05:00
Author
Owner
Copy Link
Copy Source

@fumiadder commented on GitHub (Jun 15, 2025):

CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

CSP_WHITELIST=https://img2024.cnblogs.com

Image

Restart docker after modification，The effect is the same

@fumiadder commented on GitHub (Jun 15, 2025): # CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP CSP_WHITELIST=https://img2024.cnblogs.com ![Image](https://github.com/user-attachments/assets/a22f210f-d585-458d-9caf-f426c9ef21b7) Restart docker after modification，The effect is the same
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#14570
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?