langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-22 12:36:14 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

in Dify 1.9.2 the iframe embed cannot pass the USER_ID in system variable #19934

New Issue
Closed
opened 2026-02-21 20:05:00 -05:00 by yindo · 10 comments
yindo commented 2026-02-21 20:05:00 -05:00
Owner
Copy Link
Copy Source

Originally created by @asrguru20 on GitHub (Oct 26, 2025).

Originally assigned to: @crazywoola on GitHub.

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.9.2

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

  1. create an agent
  2. use iframe to embed it to a website
  3. un comment the user id from iframe to use a random use id
  4. check the logs & Annotaions you will see the defined user id is not passed as if its not un commented

✔️ Expected Behavior

to pass the user id we used in the iframe

❌ Actual Behavior

it shows in the logs the End User or Account user id is not set by user so its the default random pattern

Originally created by @asrguru20 on GitHub (Oct 26, 2025). Originally assigned to: @crazywoola on GitHub. ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.9.2 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce 1. create an agent 2. use iframe to embed it to a website 3. un comment the user id from iframe to use a random use id 4. check the logs & Annotaions you will see the defined user id is not passed as if its not un commented ### ✔️ Expected Behavior to pass the user id we used in the iframe ### ❌ Actual Behavior it shows in the logs the End User or Account user id is not set by user so its the default random pattern
yindo added the 🤖 feat:agent label 2026-02-21 20:05:00 -05:00
yindo closed this issue 2026-02-21 20:05:00 -05:00
yindo commented 2026-02-21 20:05:00 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Oct 26, 2025):

This is a known issue in Dify 1.9.2: passing USER_ID via iframe embedding does not work as expected, and the system falls back to a random or default user ID instead of the one you specify. This happens because the frontend and backend require system variables like USER_ID to be passed as URL parameters prefixed with sys., and the value must be GZIP-compressed, Base64-encoded, and URI-encoded. If you simply uncomment or set USER_ID in the embed code without encoding and using the correct parameter name, it will be ignored or replaced by a default value discussion.

To work around this, encode your user ID and add it to the iframe URL as sys.user_id=<encoded_value>. Here’s a JavaScript example for encoding:

async function compressAndEncodeBase64(input) {
  const uint8Array = (new TextEncoder()).encode(input);
  const compressedStream = new Response(
    new Blob([uint8Array]).stream().pipeThrough(new CompressionStream("gzip"))
  ).arrayBuffer();
  const compressedUint8Array = new Uint8Array(await compressedStream);
  return btoa(String.fromCharCode(...compressedUint8Array));
}

// Usage:
compressAndEncodeBase64("your_user_id").then(encoded => {
  // Use encoded in your iframe src as sys.user_id=encoded
  // Example:
  // <iframe src="https://your-dify-url/chatbot/<token>?sys.user_id=" + encoded></iframe>
});

If you have multiple system variables, add each as its own sys.<key>=<encoded_value> parameter in the iframe URL. You cannot update these after the iframe is created example.

If you follow this approach and still see random user IDs, make sure your Dify app is set to PUBLIC access mode and that your browser or proxy isn’t stripping or altering the URL parameters. This issue affects both self-hosted and cloud deployments if the parameters are not encoded and passed correctly.

For more details and examples, see the official discussion and code references:

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Oct 26, 2025): <!-- Answer --> This is a known issue in Dify 1.9.2: passing USER_ID via iframe embedding does not work as expected, and the system falls back to a random or default user ID instead of the one you specify. This happens because the frontend and backend require system variables like USER_ID to be passed as URL parameters prefixed with `sys.`, and the value must be GZIP-compressed, Base64-encoded, and URI-encoded. If you simply uncomment or set USER_ID in the embed code without encoding and using the correct parameter name, it will be ignored or replaced by a default value [discussion](https://github.com/langgenius/dify/issues/26915). To work around this, encode your user ID and add it to the iframe URL as `sys.user_id=<encoded_value>`. Here’s a JavaScript example for encoding: ```js async function compressAndEncodeBase64(input) { const uint8Array = (new TextEncoder()).encode(input); const compressedStream = new Response( new Blob([uint8Array]).stream().pipeThrough(new CompressionStream("gzip")) ).arrayBuffer(); const compressedUint8Array = new Uint8Array(await compressedStream); return btoa(String.fromCharCode(...compressedUint8Array)); } // Usage: compressAndEncodeBase64("your_user_id").then(encoded => { // Use encoded in your iframe src as sys.user_id=encoded // Example: // <iframe src="https://your-dify-url/chatbot/<token>?sys.user_id=" + encoded></iframe> }); ``` If you have multiple system variables, add each as its own `sys.<key>=<encoded_value>` parameter in the iframe URL. You cannot update these after the iframe is created [example](https://github.com/langgenius/dify/issues/26915). If you follow this approach and still see random user IDs, make sure your Dify app is set to PUBLIC access mode and that your browser or proxy isn’t stripping or altering the URL parameters. This issue affects both self-hosted and cloud deployments if the parameters are not encoded and passed correctly. For more details and examples, see the official discussion and code references: - [How to pass system variables via iframe](https://github.com/langgenius/dify/issues/26915) - [Encoding and embedding user variables](https://github.com/langgenius/dify/issues/21768) <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/8ff2df5b-adbc-4f99-bc59-3168ae11673a?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/8ff2df5b-adbc-4f99-bc59-3168ae11673a?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/8ff2df5b-adbc-4f99-bc59-3168ae11673a?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/8ff2df5b-adbc-4f99-bc59-3168ae11673a?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/8ff2df5b-adbc-4f99-bc59-3168ae11673a?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/8ff2df5b-adbc-4f99-bc59-3168ae11673a?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/8ff2df5b-adbc-4f99-bc59-3168ae11673a?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/27468)
yindo commented 2026-02-21 20:05:00 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Oct 26, 2025):

Please see the bot's reply to see if you have used encoded value.

@crazywoola commented on GitHub (Oct 26, 2025): Please see the bot's reply to see if you have used encoded value.
yindo commented 2026-02-21 20:05:00 -05:00
Author
Owner
Copy Link
Copy Source

@shimosaka commented on GitHub (Oct 27, 2025):

@crazywoola @dosu

I am facing the same problem.

I am already sending the GZIP-compressed and Base64-encoded sys.user_id as suggested.

This worked perfectly in 1.9.1, but after upgrading to 1.9.2, my sys.user_id is ignored, and a default value is used instead.

This appears to be a critical regression. Is there any known fix or workaround?

@shimosaka commented on GitHub (Oct 27, 2025): @crazywoola @dosu I am facing the same problem. I am already sending the GZIP-compressed and Base64-encoded `sys.user_id` as suggested. This worked perfectly in 1.9.1, but after upgrading to 1.9.2, my `sys.user_id` is ignored, and a default value is used instead. This appears to be a critical regression. Is there any known fix or workaround?
yindo commented 2026-02-21 20:05:00 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Oct 27, 2025):

I will take a look at this.

@crazywoola commented on GitHub (Oct 27, 2025): I will take a look at this.
yindo commented 2026-02-21 20:05:00 -05:00
Author
Owner
Copy Link
Copy Source

@shimosaka commented on GitHub (Oct 27, 2025):

@crazywoola Thank you so much for looking into this.

I am currently facing this issue in my production environment, so this is quite critical for me. Unfortunately, downgrading back to 1.9.1 isn't an easy option, as I was facing other bugs with that version...

I really appreciate your help and am looking forward to any updates.

@shimosaka commented on GitHub (Oct 27, 2025): @crazywoola Thank you so much for looking into this. I am currently facing this issue in my production environment, so this is quite critical for me. Unfortunately, downgrading back to 1.9.1 isn't an easy option, as I was facing other bugs with that version... I really appreciate your help and am looking forward to any updates.
yindo commented 2026-02-21 20:05:00 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Oct 27, 2025):

@dosu Find recent PRs regarding this issue in the format of list

@crazywoola commented on GitHub (Oct 27, 2025): @dosu Find recent PRs regarding this issue in the format of list
yindo commented 2026-02-21 20:05:01 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Oct 27, 2025):

I did not find any recent pull requests in the Dify repository that directly address or mention the regression where sys.user_id passed via iframe is ignored in version 1.9.2. No merged PRs since 1.9.1 reference this issue, and code review shows no recent changes or fixes related to sys.user_id handling in iframe embedding. If a fix is in progress, it has not yet been merged or linked to this specific problem.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Oct 27, 2025): <!-- Answer --> I did not find any recent pull requests in the Dify repository that directly address or mention the regression where sys.user_id passed via iframe is ignored in version 1.9.2. No merged PRs since 1.9.1 reference this issue, and code review shows no recent changes or fixes related to sys.user_id handling in iframe embedding. If a fix is in progress, it has not yet been merged or linked to this specific problem. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/01bf73bd-1547-474d-8c35-9c40724f0e7f?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/01bf73bd-1547-474d-8c35-9c40724f0e7f?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/01bf73bd-1547-474d-8c35-9c40724f0e7f?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/01bf73bd-1547-474d-8c35-9c40724f0e7f?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/01bf73bd-1547-474d-8c35-9c40724f0e7f?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/01bf73bd-1547-474d-8c35-9c40724f0e7f?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/01bf73bd-1547-474d-8c35-9c40724f0e7f?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/27468)
yindo commented 2026-02-21 20:05:01 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Oct 27, 2025):

@dosu identify the root cause and give me a fix

@crazywoola commented on GitHub (Oct 27, 2025): @dosu identify the root cause and give me a fix
yindo commented 2026-02-21 20:05:01 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Oct 27, 2025):

The root cause is a regression in Dify 1.9.2: the backend no longer extracts and maps the sys.user_id parameter from iframe embeds, so the user ID is always randomly generated or defaulted instead of using the value you provide. This logic was present in 1.9.1 but is missing in 1.9.2, breaking user tracking and annotation. The relevant code paths are in the backend controller and runner, which expect explicit wiring of system variables like sys.user_id but currently do not perform this mapping see code analysis.

Fix:
Restore the extraction and assignment of sys.user_id in the backend controller handling iframe embeds. Specifically, ensure that when a request includes a sys.user_id parameter, it is decoded and used to set up the EndUser or Account for the chat session, rather than defaulting to a random ID. This means updating the controller logic to parse sys.user_id from the request, validate it, and pass it through to session/user creation and downstream logic.

If you need a code pointer:

  • In the backend controller (e.g., api/controllers/service_api/app/chat_app.py), extract sys.user_id from the incoming request.
  • Pass it to the session/user creation logic so that application_generate_entity.user_id is set to the provided value, not a random one.
  • Audit any recent validation or mapping changes that may block or discard this parameter.

This will restore the expected behavior for iframe embedding with custom user IDs.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

@dosubot[bot] commented on GitHub (Oct 27, 2025): <!-- Answer --> The root cause is a regression in Dify 1.9.2: the backend no longer extracts and maps the `sys.user_id` parameter from iframe embeds, so the user ID is always randomly generated or defaulted instead of using the value you provide. This logic was present in 1.9.1 but is missing in 1.9.2, breaking user tracking and annotation. The relevant code paths are in the backend controller and runner, which expect explicit wiring of system variables like `sys.user_id` but currently do not perform this mapping [see code analysis](https://github.com/langgenius/dify/blob/dc1ae57dc669f4dbce1daa08b37f2e78068d5074/api/core/app/apps/chat/app_generator.py). **Fix:** Restore the extraction and assignment of `sys.user_id` in the backend controller handling iframe embeds. Specifically, ensure that when a request includes a `sys.user_id` parameter, it is decoded and used to set up the EndUser or Account for the chat session, rather than defaulting to a random ID. This means updating the controller logic to parse `sys.user_id` from the request, validate it, and pass it through to session/user creation and downstream logic. If you need a code pointer: - In the backend controller (e.g., `api/controllers/service_api/app/chat_app.py`), extract `sys.user_id` from the incoming request. - Pass it to the session/user creation logic so that `application_generate_entity.user_id` is set to the provided value, not a random one. - Audit any recent validation or mapping changes that may block or discard this parameter. This will restore the expected behavior for iframe embedding with custom user IDs. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/6cc9ac25-8660-4fbe-91eb-71afcae7718f?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/6cc9ac25-8660-4fbe-91eb-71afcae7718f?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/6cc9ac25-8660-4fbe-91eb-71afcae7718f?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/6cc9ac25-8660-4fbe-91eb-71afcae7718f?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/6cc9ac25-8660-4fbe-91eb-71afcae7718f?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/6cc9ac25-8660-4fbe-91eb-71afcae7718f?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/6cc9ac25-8660-4fbe-91eb-71afcae7718f?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/27468)
yindo commented 2026-02-21 20:05:01 -05:00
Author
Owner
Copy Link
Copy Source

@shimosaka commented on GitHub (Oct 27, 2025):

@crazywoola Thank you so much for the incredibly fast fix and for submitting the pull request!
This is a huge help, as I was stuck with this in production.
I really appreciate your quick work on this!

@shimosaka commented on GitHub (Oct 27, 2025): @crazywoola Thank you so much for the incredibly fast fix and for submitting the pull request! This is a huge help, as I was stuck with this in production. I really appreciate your quick work on this!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🤖 feat:agent
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#19934
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?