langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-08-27 03:01:54 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Access external knowledge return 403 Forbidden #15022

New Issue
Closed
opened 2026-02-21 19:19:49 -05:00 by yindo · 5 comments
yindo commented 2026-02-21 19:19:49 -05:00
Owner
Copy Link
Copy Source

Originally created by @liuxh613 on GitHub (Jul 1, 2025).

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.5.0

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

I am using an external knowledge to access ragflow's KB.
ragflow version: v0.19.1 full
ragflow port : 8180

When performing a retrieval test, I observed the following logs using docker logs -f dify-api-1:

1751352803.510 129 172.21.0.7 TCP_MISS/403 294 POST http://172.22.129.36:8180/api/v1/dify/retrieval⁠ - HIER_DIRECT/172.22.129.36 application/json

and ragflow-server log:
2025-07-01 15:01:14,155 INFO 20 172.19.0.6 - - [01/Jul/2025 15:01:14] "POST /api/v1/dify/retrieval HTTP/1.1" 403 -
I already modified the squid.conf.template file and added:

acl Safe_ports port 8180
acl Safe_ports port 9380

then restart docker compose.

and i check the request : http://172.22.129.36:8021/console/api/datasets/4d7bdb61-ef94-436e-aa85-a9d3dd9b7564/external-hit-testing
the respose is :
{"query": {"content": "\u63d0\u5355\u72b6\u6001"}, "records": []}
records is empty.

✔️ Expected Behavior

No response

❌ Actual Behavior

No response

Originally created by @liuxh613 on GitHub (Jul 1, 2025). ### Self Checks - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [x] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:) - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.5.0 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce I am using an external knowledge to access ragflow's KB. ragflow version: v0.19.1 full ragflow port : 8180 When performing a retrieval test, I observed the following logs using docker logs -f dify-api-1: `1751352803.510 129 172.21.0.7 TCP_MISS/403 294 POST http://172.22.129.36:8180/api/v1/dify/retrieval⁠ - HIER_DIRECT/172.22.129.36 application/json` and ragflow-server log: `2025-07-01 15:01:14,155 INFO 20 172.19.0.6 - - [01/Jul/2025 15:01:14] "POST /api/v1/dify/retrieval HTTP/1.1" 403 - ` I already modified the squid.conf.template file and added: ``` acl Safe_ports port 8180 acl Safe_ports port 9380 ``` then restart docker compose. and i check the request : http://172.22.129.36:8021/console/api/datasets/4d7bdb61-ef94-436e-aa85-a9d3dd9b7564/external-hit-testing the respose is : {"query": {"content": "\u63d0\u5355\u72b6\u6001"}, "records": []} records is empty. ### ✔️ Expected Behavior _No response_ ### ❌ Actual Behavior _No response_
yindo added the 🐞 bug label 2026-02-21 19:19:49 -05:00
yindo closed this issue 2026-02-21 19:19:49 -05:00
yindo commented 2026-02-21 19:19:49 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Jul 1, 2025):

A 403 Forbidden error when accessing external knowledge via ragflow almost always means an authentication or permission issue on the ragflow side, not a network or proxy problem. Dify sends the API key as a Bearer token in the Authorization header by default. If ragflow returns 403, it usually means the API key is missing, invalid, or not what ragflow expects, or the endpoint is misconfigured (wrong URL, protocol, or port) [source].

Double-check that:

  • The API key in Dify matches what ragflow expects for that endpoint.
  • The endpoint URL in Dify is correct, including protocol (http:// or https://) and port.
  • Ragflow is configured to accept requests from Dify’s IP (no IP allowlist or firewall is blocking).
  • If ragflow expects a different header or authentication method, update Dify’s external knowledge config accordingly.

You can also try sending a manual POST request (using curl or Postman) to ragflow’s /api/v1/dify/retrieval with the same Authorization header and payload as Dify to see if you get the same 403. If so, the issue is definitely on the ragflow side (API key, permissions, or endpoint config).

Proxy or network issues would typically result in a 502 or timeout, not a 403. If you need to support a custom header or auth type, Dify does allow advanced configuration, but Bearer is the default and expected for most setups [source].

If you’ve checked all of the above and still get a 403, check ragflow’s logs for more details on why the request is being denied.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Join Discord Share on X

@dosubot[bot] commented on GitHub (Jul 1, 2025): <!-- Answer --> A 403 Forbidden error when accessing external knowledge via ragflow almost always means an authentication or permission issue on the ragflow side, not a network or proxy problem. Dify sends the API key as a Bearer token in the Authorization header by default. If ragflow returns 403, it usually means the API key is missing, invalid, or not what ragflow expects, or the endpoint is misconfigured (wrong URL, protocol, or port) [[source](https://github.com/langgenius/dify/blob/1a7ad195f01cd6d246860ac16ba3371826c34295/api/services/external_knowledge_service.py)]. Double-check that: - The API key in Dify matches what ragflow expects for that endpoint. - The endpoint URL in Dify is correct, including protocol (`http://` or `https://`) and port. - Ragflow is configured to accept requests from Dify’s IP (no IP allowlist or firewall is blocking). - If ragflow expects a different header or authentication method, update Dify’s external knowledge config accordingly. You can also try sending a manual POST request (using curl or Postman) to ragflow’s `/api/v1/dify/retrieval` with the same Authorization header and payload as Dify to see if you get the same 403. If so, the issue is definitely on the ragflow side (API key, permissions, or endpoint config). Proxy or network issues would typically result in a 502 or timeout, not a 403. If you need to support a custom header or auth type, Dify does allow advanced configuration, but Bearer is the default and expected for most setups [[source](https://github.com/langgenius/dify/blob/1a7ad195f01cd6d246860ac16ba3371826c34295/api/services/entities/external_knowledge_entities/external_knowledge_entities.py)]. If you’ve checked all of the above and still get a 403, check ragflow’s logs for more details on why the request is being denied. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/a9ea996a-8eb6-4247-8cb4-37dd95d8c8ca?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/a9ea996a-8eb6-4247-8cb4-37dd95d8c8ca?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/a9ea996a-8eb6-4247-8cb4-37dd95d8c8ca?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/a9ea996a-8eb6-4247-8cb4-37dd95d8c8ca?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/a9ea996a-8eb6-4247-8cb4-37dd95d8c8ca?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/a9ea996a-8eb6-4247-8cb4-37dd95d8c8ca?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/a9ea996a-8eb6-4247-8cb4-37dd95d8c8ca?feedback_type=other)</sup>&nbsp;&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/21744)
yindo commented 2026-02-21 19:19:49 -05:00
Author
Owner
Copy Link
Copy Source

@CS-LZF commented on GitHub (Jul 8, 2025):

I also encountered this issue, my DIY version is 1.5.1. The root cause of this problem is another bug. After resetting the API key of Ragflow, I updated the external knowledge base API key in dify, but the value of the API key parameter was not actually updated. I checked the database and found that the API key is still at its original value.

For now, this issue can be avoided by deleting external knowledge bases and adding new ones.

@CS-LZF commented on GitHub (Jul 8, 2025): I also encountered this issue, my DIY version is 1.5.1. The root cause of this problem is another bug. After resetting the API key of Ragflow, I updated the external knowledge base API key in dify, but the value of the API key parameter was not actually updated. I checked the database and found that the API key is still at its original value. For now, this issue can be avoided by deleting external knowledge bases and adding new ones.
yindo commented 2026-02-21 19:19:50 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Aug 27, 2025):

Hi, @liuxh613. I'm Dosu, and I'm helping the Dify team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You reported a 403 Forbidden error when accessing an external knowledge base via ragflow in a self-hosted Dify 1.5.0 Docker setup.
  • The error was likely due to authentication or proxy issues on ragflow's side.
  • It was confirmed that in Dify 1.5.1, updating the API key for ragflow does not persist in the database.
  • The recommended workaround was to delete and re-add the external knowledge base to resolve the 403 error.

Next Steps:

  • Please check if this issue is still relevant with the latest version of Dify.
  • If it is, feel free to comment here to keep the discussion open; otherwise, I will automatically close this issue in 15 days.

Thank you for your understanding and contribution!

@dosubot[bot] commented on GitHub (Aug 27, 2025): Hi, @liuxh613. I'm [Dosu](https://dosu.dev), and I'm helping the Dify team manage their backlog and am marking this issue as stale. **Issue Summary:** - You reported a 403 Forbidden error when accessing an external knowledge base via ragflow in a self-hosted Dify 1.5.0 Docker setup. - The error was likely due to authentication or proxy issues on ragflow's side. - It was confirmed that in Dify 1.5.1, updating the API key for ragflow does not persist in the database. - The recommended workaround was to delete and re-add the external knowledge base to resolve the 403 error. **Next Steps:** - Please check if this issue is still relevant with the latest version of Dify. - If it is, feel free to comment here to keep the discussion open; otherwise, I will automatically close this issue in 15 days. Thank you for your understanding and contribution!
yindo commented 2026-02-21 19:19:50 -05:00
Author
Owner
Copy Link
Copy Source

@PinkFloydddd commented on GitHub (Nov 17, 2025):

help,i also have this issue

@PinkFloydddd commented on GitHub (Nov 17, 2025): help,i also have this issue
yindo commented 2026-02-21 19:19:50 -05:00
Author
Owner
Copy Link
Copy Source

@PinkFloydddd commented on GitHub (Nov 17, 2025):

Hi, @liuxh613. I'm Dosu, and I'm helping the Dify team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You reported a 403 Forbidden error when accessing an external knowledge base via ragflow in a self-hosted Dify 1.5.0 Docker setup.
  • The error was likely due to authentication or proxy issues on ragflow's side.
  • It was confirmed that in Dify 1.5.1, updating the API key for ragflow does not persist in the database.
  • The recommended workaround was to delete and re-add the external knowledge base to resolve the 403 error.

Next Steps:

  • Please check if this issue is still relevant with the latest version of Dify.
  • If it is, feel free to comment here to keep the discussion open; otherwise, I will automatically close this issue in 15 days.

Thank you for your understanding and contribution!

I tried to do this, but the problem still existed

@PinkFloydddd commented on GitHub (Nov 17, 2025): > Hi, [@liuxh613](https://github.com/liuxh613). I'm [Dosu](https://dosu.dev), and I'm helping the Dify team manage their backlog and am marking this issue as stale. > > **Issue Summary:** > > * You reported a 403 Forbidden error when accessing an external knowledge base via ragflow in a self-hosted Dify 1.5.0 Docker setup. > * The error was likely due to authentication or proxy issues on ragflow's side. > * It was confirmed that in Dify 1.5.1, updating the API key for ragflow does not persist in the database. > * The recommended workaround was to delete and re-add the external knowledge base to resolve the 403 error. > > **Next Steps:** > > * Please check if this issue is still relevant with the latest version of Dify. > * If it is, feel free to comment here to keep the discussion open; otherwise, I will automatically close this issue in 15 days. > > Thank you for your understanding and contribution! I tried to do this, but the problem still existed
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#15022
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?