langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 03:55:25 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Paraneter key decryption error #16365

New Issue
Closed
opened 2026-02-21 19:25:49 -05:00 by yindo · 4 comments
yindo commented 2026-02-21 19:25:49 -05:00
Owner
Copy Link
Copy Source

Originally created by @pankaj4u4m on GitHub (Aug 22, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.7.2

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

Add google address validator

curl -X POST -d '{
"address": {
"regionCode": "US",
"locality": "Mountain View",
"addressLines": ["1600 Amphitheatre Pkwy"]
}
}'
-H 'Content-Type: application/json'
"https://addressvalidation.googleapis.com/v1:validateAddress?key=API_KEY"

https://developers.google.com/maps/documentation/address-validation/get-api-key

Console shows it is requesting url:
2025-08-22 12:48:39.518 INFO [Dummy-12] [_client.py:1038] - HTTP Request: POST https://addressvalidation.googleapis.com/v1:validateAddress?key=AI%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2Ahg "HTTP/1.1 400 Bad Request"

It is using masked key AI***********************************hg and hot the real key.

✔️ Expected Behavior

should used unmasked key.

❌ Actual Behavior

masked key is passed into the url

Originally created by @pankaj4u4m on GitHub (Aug 22, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.7.2 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce Add google address validator curl -X POST -d '{ "address": { "regionCode": "US", "locality": "Mountain View", "addressLines": ["1600 Amphitheatre Pkwy"] } }' \ -H 'Content-Type: application/json' \ "https://addressvalidation.googleapis.com/v1:validateAddress?key=API_KEY" https://developers.google.com/maps/documentation/address-validation/get-api-key Console shows it is requesting url: 2025-08-22 12:48:39.518 INFO [Dummy-12] [_client.py:1038] - HTTP Request: POST https://addressvalidation.googleapis.com/v1:validateAddress?key=AI%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2A%2Ahg "HTTP/1.1 400 Bad Request" It is using masked key AI***********************************hg and hot the real key. ### ✔️ Expected Behavior should used unmasked key. ### ❌ Actual Behavior masked key is passed into the url
yindo added the 🐞 bug label 2026-02-21 19:25:49 -05:00
yindo closed this issue 2026-02-21 19:25:49 -05:00
yindo commented 2026-02-21 19:25:49 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Aug 22, 2025):

Hi @pankaj4u4m! I'm Dosu and I’m helping the dify team.

This is a known issue in Dify where secret environment variables (like API keys) can be passed as their masked value (e.g., AI***********************************hg) instead of the real secret in outbound requests. This happens due to a bug in the secret handling pipeline, where the masked value is mistakenly saved or restored as the actual secret, especially during plugin or API integration workflows. There is currently no documented workaround to ensure the original key is always passed; re-entering the real API key in the configuration (not the masked value) may help in some cases, but the underlying bug is not yet fixed as of the latest reports. You may want to monitor for updates or patches that address this bug in future Dify releases.
Reference

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Aug 22, 2025): <!-- Greeting --> Hi @pankaj4u4m! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the dify team. <!-- Answer --> This is a known issue in Dify where secret environment variables (like API keys) can be passed as their masked value (e.g., `AI***********************************hg`) instead of the real secret in outbound requests. This happens due to a bug in the secret handling pipeline, where the masked value is mistakenly saved or restored as the actual secret, especially during plugin or API integration workflows. There is currently no documented workaround to ensure the original key is always passed; re-entering the real API key in the configuration (not the masked value) may help in some cases, but the underlying bug is not yet fixed as of the latest reports. You may want to monitor for updates or patches that address this bug in future Dify releases. [Reference](https://github.com/langgenius/dify/discussions/18793) <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/922b0b67-62cb-47d5-b81d-200697d10d5b?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/922b0b67-62cb-47d5-b81d-200697d10d5b?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/922b0b67-62cb-47d5-b81d-200697d10d5b?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/922b0b67-62cb-47d5-b81d-200697d10d5b?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/922b0b67-62cb-47d5-b81d-200697d10d5b?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/922b0b67-62cb-47d5-b81d-200697d10d5b?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/922b0b67-62cb-47d5-b81d-200697d10d5b?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/24367)
yindo commented 2026-02-21 19:25:50 -05:00
Author
Owner
Copy Link
Copy Source

@pankaj4u4m commented on GitHub (Aug 22, 2025):

I already fixed it locally, I can send a patch

@pankaj4u4m commented on GitHub (Aug 22, 2025): I already fixed it locally, I can send a patch
yindo commented 2026-02-21 19:25:50 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Aug 22, 2025):

I already fixed it locally, I can send a patch

Cool, that was quick.

@crazywoola commented on GitHub (Aug 22, 2025): > I already fixed it locally, I can send a patch Cool, that was quick.
yindo commented 2026-02-21 19:25:50 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Sep 23, 2025):

Hi, @pankaj4u4m. I'm Dosu, and I'm helping the Dify team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You reported that in Dify v1.7.2 (self-hosted via Docker), the Google address validator API request uses a masked API key, resulting in a 400 error.
  • This is due to a known bug in Dify's secret handling pipeline where masked secrets are mistakenly used in requests.
  • There is currently no official fix available in the main codebase.
  • You mentioned having a local fix and offered to submit a patch, which the maintainer acknowledged positively.

Next Steps:

  • Please let me know if this issue is still relevant with the latest version of Dify by commenting here to keep the discussion open.
  • Otherwise, this issue will be automatically closed in 15 days.

Thank you for your understanding and contribution!

@dosubot[bot] commented on GitHub (Sep 23, 2025): Hi, @pankaj4u4m. I'm [Dosu](https://dosu.dev), and I'm helping the Dify team manage their backlog and am marking this issue as stale. **Issue Summary:** - You reported that in Dify v1.7.2 (self-hosted via Docker), the Google address validator API request uses a masked API key, resulting in a 400 error. - This is due to a known bug in Dify's secret handling pipeline where masked secrets are mistakenly used in requests. - There is currently no official fix available in the main codebase. - You mentioned having a local fix and offered to submit a patch, which the maintainer acknowledged positively. **Next Steps:** - Please let me know if this issue is still relevant with the latest version of Dify by commenting here to keep the discussion open. - Otherwise, this issue will be automatically closed in 15 days. Thank you for your understanding and contribution!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#16365
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?