Use an external Nginx proxy #20681

New Issue

2026-02-21T20:08:26-05:00

yindo commented

2026-02-21 20:08:26 -05:00

Originally created by @bumblebee-code-gh on GitHub (Nov 28, 2025).

Self Checks

I have read the Contributing Guide and Language Policy.
This is only for bug report, if you would like to ask a question, please head to Discussions.
I have searched for existing issues search for existing issues, including closed ones.
I confirm that I am using English to submit this report, otherwise it will be closed.
【中文用户 & Non English User】请使用英语提交，否则会被关闭：）
Please do not modify this template :) and fill in all the required fields.

Dify version

1.9.1

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

Content

I encountered some issues while using an external Nginx proxy, Dify.

Dify version 1.9.1 is deployed using Docker and uses port 18081.
The external Nginx is also deployed in Docker and uses port 80.
The Docker IP address is 172.21.240.1.
The host machine's IP address is 192.168.1.13.

I have modified some content in the following files:

1. Frontend:

dify/web/Dockerfile
```
ENV NEXT_PUBLIC_BASE_PATH=/dify
```

dify/docker/docker-compose.yaml

web:
  build:
  context: ../web
  dockerfile: Dockerfile
image: langgenius/dify-web:1.9.1

Rebuild the frontend Docker image after these changes.

2. External Nginx (gateway):

server {
    listen       80;
    listen  [::]:80;
    server_name  localhost;
	
	# API routes: strip /dify prefix
	location ~ ^/dify/(console/api|api|v1)/ {
		rewrite ^/dify/(.*)$ /$1 break;
		proxy_pass http://172.21.240.1:18081;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header X-Forwarded-Prefix /dify;
	}

	# Frontend/static assets: keep /dify prefix
	location /dify/ {
		proxy_pass http://172.21.240.1:18081/dify/;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header X-Forwarded-Prefix /dify;
	}
}

3. Backend:

dify/docker/.env

# The backend URL of the console API,
# used to concatenate the authorization callback.
# If empty, it is the same domain.
# Example: https://api.console.dify.ai
CONSOLE_API_URL=http://192.168.1.13:80/dify

......

# WebApp API backend Url,
# used to declare the back-end URL for the front-end API.
# If empty, it is the same domain.
# Example: https://api.app.dify.ai
APP_API_URL=http://192.168.1.13:80/dify

......

# ------------------------------
# Docker Compose Service Expose Host Port Configurations
# ------------------------------
EXPOSE_NGINX_PORT=18081
EXPOSE_NGINX_SSL_PORT=443

......

# Respect X-* headers to redirect clients
RESPECT_XFORWARD_HEADERS_ENABLED=true

✔️ Expected Behavior

Accessing http://192.168.1.13/dify/signin or http://192.168.1.13/dify/app in your browser should allow you to use Dify normally.

❌ Actual Behavior

1.When accessing http://192.168.1.13/dify/signin through a browser, the browser console displays the following error.

http://192.168.1.13/dify/console/api/account/profile 401 (UNAUTHORIZED)
http://192.168.1.13/dify/console/api/refresh-token 400 (BAD REQUEST)

2.When logging in with my username and password, the following error occurred, and the Dify frontend cannot be opened normally.

http://192.168.1.13/dify/console/api/workspaces 401 (UNAUTHORIZED)
http://192.168.1.13/dify/console/api/workspaces/current/models/model-types/llm 401 (UNAUTHORIZED)

.....

Almost all requests returned a 401 (UNAUTHORIZED) error.

Originally created by @bumblebee-code-gh on GitHub (Nov 28, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.9.1 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce ### Content I encountered some issues while using an external Nginx proxy, Dify. - Dify version 1.9.1 is deployed using Docker and uses port 18081. - The external Nginx is also deployed in Docker and uses port 80. - The Docker IP address is 172.21.240.1. - The host machine's IP address is 192.168.1.13. I have modified some content in the following files: **1. Frontend:** - `dify/web/Dockerfile` ``` ENV NEXT_PUBLIC_BASE_PATH=/dify ``` - `dify/docker/docker-compose.yaml` ``` web: build: context: ../web dockerfile: Dockerfile image: langgenius/dify-web:1.9.1 ``` - **Rebuild the frontend Docker image after these changes.** **2. External Nginx (gateway):** ``` server { listen 80; listen [::]:80; server_name localhost; # API routes: strip /dify prefix location ~ ^/dify/(console/api|api|v1)/ { rewrite ^/dify/(.*)$ /$1 break; proxy_pass http://172.21.240.1:18081; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Prefix /dify; } # Frontend/static assets: keep /dify prefix location /dify/ { proxy_pass http://172.21.240.1:18081/dify/; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Prefix /dify; } } ``` **3. Backend:** - `dify/docker/.env` ``` # The backend URL of the console API, # used to concatenate the authorization callback. # If empty, it is the same domain. # Example: https://api.console.dify.ai CONSOLE_API_URL=http://192.168.1.13:80/dify ...... # WebApp API backend Url, # used to declare the back-end URL for the front-end API. # If empty, it is the same domain. # Example: https://api.app.dify.ai APP_API_URL=http://192.168.1.13:80/dify ...... # ------------------------------ # Docker Compose Service Expose Host Port Configurations # ------------------------------ EXPOSE_NGINX_PORT=18081 EXPOSE_NGINX_SSL_PORT=443 ...... # Respect X-* headers to redirect clients RESPECT_XFORWARD_HEADERS_ENABLED=true ``` ### ✔️ Expected Behavior Accessing http://192.168.1.13/dify/signin or http://192.168.1.13/dify/app in your browser should allow you to use Dify normally. ### ❌ Actual Behavior 1.When accessing http://192.168.1.13/dify/signin through a browser, the browser console displays the following error. > http://192.168.1.13/dify/console/api/account/profile 401 (UNAUTHORIZED) > http://192.168.1.13/dify/console/api/refresh-token 400 (BAD REQUEST) 2.When logging in with my username and password, the following error occurred, and the Dify frontend cannot be opened normally. > http://192.168.1.13/dify/console/api/workspaces 401 (UNAUTHORIZED) > http://192.168.1.13/dify/console/api/workspaces/current/models/model-types/llm 401 (UNAUTHORIZED) ..... Almost all requests returned a 401 (UNAUTHORIZED) error. <img width="1919" height="997" alt="Image" src="https://github.com/user-attachments/assets/adff4512-97bc-409e-a8dd-5be478634839" /> <img width="1916" height="998" alt="Image" src="https://github.com/user-attachments/assets/c865d3b3-376b-4798-94e9-61c2348ef4c4" />

yindo added the 🐞 bug label 2026-02-21 20:08:26 -05:00

yindo closed this issue

2026-02-21 20:08:26 -05:00

yindo commented

2026-02-21 20:08:26 -05:00

@dosubot[bot] commented on GitHub (Nov 28, 2025):

You’re very close—this setup is a common source of 401/400 errors with Dify behind an external Nginx proxy. Here’s a focused checklist and troubleshooting guide based on best practices and known issues:

Frontend build:
Dify’s frontend must be built with the correct basePath and assetPrefix (e.g., /dify) in web/utils/var-basePath.js (and sometimes web/utils/var.ts) before building the Docker image. Just setting NEXT_PUBLIC_BASE_PATH in the Dockerfile is not enough; you must edit these files and then rebuild the image. This ensures static assets and routing work under /dify [source].
Backend environment variables:
All backend URL variables (CONSOLE_API_URL, APP_API_URL, SERVICE_API_URL, CONSOLE_WEB_URL, APP_WEB_URL, FILES_URL) must include the full external URL with the /dify subpath (e.g., http://192.168.1.13:80/dify). This is required for correct link generation and authentication callbacks [source].
Nginx proxy rules:
- For API routes, strip the /dify prefix before proxying to the backend (as you have).
- For static assets and frontend, keep the /dify prefix.
- Always set X-Forwarded-Prefix: /dify and other X-Forwarded-* headers.
- Only use one location block per path to avoid conflicts [source].
RESPECT_XFORWARD_HEADERS_ENABLED:
This should be set to true in your backend .env to ensure Dify respects forwarded headers from the proxy [source].
CORS and cookies:
If you use cookies for authentication, set CONSOLE_CORS_ALLOW_ORIGINS and WEB_API_CORS_ALLOW_ORIGINS to your domain (not *). If you’re using subdomains, set COOKIE_DOMAIN accordingly. Check that cookies are being set and sent in browser DevTools—missing or blocked cookies (due to SameSite or domain issues) will cause 401/400 errors [source].
Debugging tips:
- Use browser DevTools to inspect request/response headers and cookies for API calls. Look for missing cookies, CORS errors, or redirects.
- Check backend logs for authentication or CSRF errors.
- If you see 400 on /refresh-token, it often means the refresh token cookie is missing or invalid—usually a symptom of a cookie or path/domain mismatch.

Summary diagram:

graph LR
    A["Browser"] -- /dify/console/api/* --> B["External Nginx (strips /dify)"]
    B -- /console/api/* --> C["Dify Backend (expects root paths)"]
    A -- /dify/_next/static/* --> B
    B -- /dify/_next/static/* --> C

If you follow this checklist and still see 401/400 errors, please share the request/response headers and cookies for a failing API call (from browser DevTools), and any relevant backend log messages. This will help pinpoint whether it’s a proxy, cookie, or CORS issue.

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Nov 28, 2025):  You’re very close—this setup is a common source of 401/400 errors with Dify behind an external Nginx proxy. Here’s a focused checklist and troubleshooting guide based on best practices and known issues: 1. **Frontend build:** Dify’s frontend must be built with the correct basePath and assetPrefix (e.g., `/dify`) in `web/utils/var-basePath.js` (and sometimes `web/utils/var.ts`) before building the Docker image. Just setting `NEXT_PUBLIC_BASE_PATH` in the Dockerfile is not enough; you must edit these files and then rebuild the image. This ensures static assets and routing work under `/dify` [[source]](https://github.com/langgenius/dify/discussions/21826). 2. **Backend environment variables:** All backend URL variables (`CONSOLE_API_URL`, `APP_API_URL`, `SERVICE_API_URL`, `CONSOLE_WEB_URL`, `APP_WEB_URL`, `FILES_URL`) must include the full external URL with the `/dify` subpath (e.g., `http://192.168.1.13:80/dify`). This is required for correct link generation and authentication callbacks [[source]](https://github.com/langgenius/dify/discussions/28032). 3. **Nginx proxy rules:** - For API routes, strip the `/dify` prefix before proxying to the backend (as you have). - For static assets and frontend, keep the `/dify` prefix. - Always set `X-Forwarded-Prefix: /dify` and other `X-Forwarded-*` headers. - Only use one `location` block per path to avoid conflicts [[source]](https://github.com/langgenius/dify/issues/25793). 4. **RESPECT_XFORWARD_HEADERS_ENABLED:** This should be set to `true` in your backend `.env` to ensure Dify respects forwarded headers from the proxy [[source]](https://github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/api/extensions/ext_proxy_fix.py#L5-L9). 5. **CORS and cookies:** If you use cookies for authentication, set `CONSOLE_CORS_ALLOW_ORIGINS` and `WEB_API_CORS_ALLOW_ORIGINS` to your domain (not `*`). If you’re using subdomains, set `COOKIE_DOMAIN` accordingly. Check that cookies are being set and sent in browser DevTools—missing or blocked cookies (due to SameSite or domain issues) will cause 401/400 errors [[source]](https://github.com/langgenius/dify/issues/25793). 6. **Debugging tips:** - Use browser DevTools to inspect request/response headers and cookies for API calls. Look for missing cookies, CORS errors, or redirects. - Check backend logs for authentication or CSRF errors. - If you see 400 on `/refresh-token`, it often means the refresh token cookie is missing or invalid—usually a symptom of a cookie or path/domain mismatch. **Summary diagram:** ```mermaid graph LR A["Browser"] -- /dify/console/api/* --> B["External Nginx (strips /dify)"] B -- /console/api/* --> C["Dify Backend (expects root paths)"] A -- /dify/_next/static/* --> B B -- /dify/_next/static/* --> C ``` If you follow this checklist and still see 401/400 errors, please share the request/response headers and cookies for a failing API call (from browser DevTools), and any relevant backend log messages. This will help pinpoint whether it’s a proxy, cookie, or CORS issue.  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- How did I do? [Good](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=other) [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github) [![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=You%E2%80%99re%20very%20close%E2%80%94this%20setup%20is%20a%20common%20source%20of%20401/400%20errors%20with%20Dify%20behind%20an%20external%20Nginx%20proxy.%20Here%E2%80%99s%20a%20focused%20checklist%20and%20troubleshooting%20guide%20based%20on%20best%20practices%20and%20known%20issues%3A%0A%0A1.%20%2A%2AFrontend%20build%3A%2A%2A%20%20%0A%20%20%20Dify%E2%80%99s%20frontend%20must%20be%20built%20with%20the%20correct%20basePath%20and%20assetPrefix%20%28e.g.%2C%20%60/dify%60%29%20in%20%60web/utils/var-basePath.js%60%20%28and%20sometimes%20%60web/utils/var.ts%60%29%20before%20building%20the%20Docker%20image.%20Just%20setting%20%60NEXT_PUBLIC_BASE_PATH%60%20in%20the%20Dockerfile%20is%20not%20enough%3B%20you%20must%20edit%20these%20files%20and%20then%20rebuild%20the%20image.%20This%20ensures%20static%20assets%20and%20routing%20work%20under%20%60/dify%60%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/discussions/21826%29.%0A%0A2.%20%2A%2ABackend%20environment%20variables%3A%2A%2A%20%20%0A%20%20%20All%20backend%20URL%20variables%20%28%60CONSOLE_API_URL%60%2C%20%60APP_API_URL%60%2C%20%60SERVICE_API_URL%60%2C%20%60CONSOLE_WEB_URL%60%2C%20%60APP_WEB_URL%60%2C%20%60FILES_URL%60%29%20must%20include%20the%20full%20external%20URL%20with%20the%20%60/dify%60%20subpath%20%28e.g.%2C%20%60http%3A//192.168.1.13%3A80/dify%60%29.%20This%20is%20required%20for%20correct%20link%20generation%20and%20authentication%20callbacks%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/discussions/28032%29.%0A%0A3.%20%2A%2ANginx%20proxy%20rules%3A%2A%2A%20%20%0A%20%20%20-%20For%20API%20routes%2C%20strip%20the%20%60/dify%60%20prefix%20before%20proxying%20to%20the%20backend%20%28as%20you%20have%29.%0A%20%20%20-%20For%20static%20assets%20and%20frontend%2C%20keep%20the%20%60/dify%60%20prefix.%0A%20%20%20-%20Always%20set%20%60X-Forwarded-Prefix%3A%20/dify%60%20and%20other%20%60X-Forwarded-%2A%60%20headers.%0A%20%20%20-%20Only%20use%20one%20%60location%60%20block%20per%20path%20to%20avoid%20conflicts%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/issues/25793%29.%0A%0A4.%20%2A%2ARESPECT_XFORWARD_HEADERS_ENABLED%3A%2A%2A%20%20%0A%20%20%20This%20should%20be%20set%20to%20%60true%60%20in%20your%20backend%20%60.env%60%20to%20ensure%20Dify%20respects%20forwarded%20headers%20from%20the%20proxy%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/api/extensions/ext_proxy_fix.py%23L5-L9%29.%0A%0A5.%20%2A%2ACORS%20and%20cookies%3A%2A%2A%20%20%0A%20%20%20If%20you%20use%20cookies%20for%20authentication%2C%20set%20%60CONSOLE_CORS_ALLOW_ORIGINS%60%20and%20%60WEB_API_CORS_ALLOW_ORIGINS%60%20to%20your%20domain%20%28not%20%60%2A%60%29.%20If%20you%E2%80%99re%20using%20subdomains%2C%20set%20%60COOKIE_DOMAIN%60%20accordingly.%20Check%20that%20cookies%20are%20being%20set%20and%20sent%20in%20browser%20DevTools%E2%80%94missing%20or%20blocked%20cookies%20%28due%20to%20SameSite%20or%20domain%20issues%29%20will%20cause%20401/400%20errors%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/issues/25793%29.%0A%0A6.%20%2A%2ADebugging%20tips%3A%2A%2A%20%20%0A%20%20%20-%20Use%20browser%20DevTools%20to%20inspect%20request/response%20headers%20and%20cookies%20for%20API%20calls.%20Look%20for%20missing%20cookies%2C%20CORS%20errors%2C%20or%20redirects.%0A%20%20%20-%20Check%20backend%20logs%20for%20authentication%20or%20CSRF%20errors.%0A%20%20%20-%20If%20you%20see%20400%20on%20%60/refresh-token%60%2C%20it%20often%20means%20the%20refresh%20token%20cookie%20is%20missing%20or%20invalid%E2%80%94usually%20a%20symptom%20of%20a%20cookie%20or%20path/domain%20mismatch.%0A%0A%2A%2ASummary%20diagram%3A%2A%2A%0A%0A%60%60%60mermaid%0Agraph%20LR%0A%20%20%20%20A%5B%22Browser%22%5D%20--%20/dify/console/api/%2A%20--%3E%20B%5B%22External%20Nginx%20%28strips%20/dify%29%22%5D%0A%20%20%20%20B%20--%20/console/api/%2A%20--%3E%20C%5B%22Dify%20Backend%20%28expects%20root%20paths%29%22%5D%0A%20%20%20%20A%20--%20/dify/_next/static/%2A%20--%3E%20B%0A%20%20%20%20B%20--%20/dify/_next/static/%2A%20--%3E%20C%0A%60%60%60%0A%0AIf%20you%20follow%20this%20checklist%20and%20still%20see%20401/400%20errors%2C%20please%20share%20the%20request/response%20headers%20and%20cookies%20for%20a%20failing%20API%20call%20%28from%20browser%20DevTools%29%2C%20and%20any%20relevant%20backend%20log%20messages.%20This%20will%20help%20pinpoint%20whether%20it%E2%80%99s%20a%20proxy%2C%20cookie%2C%20or%20CORS%20issue.) [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28927)

yindo commented

2026-02-21 20:08:27 -05:00

@bumblebee-code-gh commented on GitHub (Nov 29, 2025):

你已经非常接近正确答案了——这种配置是 Dify 在外部 Nginx 代理后出现 401/400 错误的常见原因。以下是基于最佳实践和已知问题的重点检查清单和故障排除指南：

前端构建： Dify 的前端必须在构建 Docker 镜像之前，
使用正确的 basePath 和 assetPrefix（例如 <basePath> 和 <assetPrefix>）进行构建（有时还需要/dify在<assetPrefix> 中设置）。仅仅在 Dockerfile 中进行设置是不够的；您必须编辑这些文件，然后重新构建镜像。这可以确保静态资源和路由在[source]下正常工作。web/utils/var-basePath.js``web/utils/var.ts``NEXT_PUBLIC_BASE_PATH``/dify

****后端**环境变量：**所有
后端 URL 变量（CONSOLE_API_URL，，，，，）必须包含完整的外部 URL 及其子路径（例如，）。这是正确生成链接和身份验证回调所必需的[来源]。APP_API_URL``SERVICE_API_URL``CONSOLE_WEB_URL``APP_WEB_URL``FILES_URL``/dify``http://192.168.1.13:80/dify

Nginx代理规则：

对于 API 路由，/dify在代理到后端之前，请先去除前缀（就像您所做的那样）。

对于静态资源和前端，保留/dify前缀。

始终设置X-Forwarded-Prefix: /dify和其他X-Forwarded-*标头。

每条路径只使用一个location块以避免冲突[来源]。

**RESPECT_XFORWARD_HEADERS_ENABLED：**应在后端
设置此项，以确保 Dify 尊重来自代理的转发标头[来源]。true``.env

CORS 和 Cookie：
如果您使用 Cookie 进行身份验证，请将 <yourdomain>``CONSOLE_CORS_ALLOW_ORIGINS和<yourdomain> 设置WEB_API_CORS_ALLOW_ORIGINS为您的域名（而非 *<yourdomain>）。如果您使用子域名，请COOKIE_DOMAIN相应地进行设置。请在浏览器开发者工具中检查 Cookie 是否已设置和发送——缺少或被阻止的 Cookie（由于 SameSite 或域名问题）会导致 401/400 错误[来源]。

调试技巧：

使用浏览器开发者工具检查 API 调用的请求/响应标头和 Cookie。查找缺失的 Cookie、CORS 错误或重定向。

检查后端日志是否存在身份验证或 CSRF 错误。

如果看到 400 /refresh-token，通常意味着刷新令牌 cookie 丢失或无效——通常是 cookie 或路径/域不匹配的症状。

概要图：

如果您按照此清单操作后仍然遇到 401/400 错误，请提供失败 API 调用的请求/响应标头和 Cookie（通过浏览器开发者工具查看），以及任何相关的后端日志消息。这将有助于确定问题是出在代理、Cookie 还是 CORS 上。

回复时只需提及@dosu即可。

我��得怎么样？好|无关|错误|冗长|幻觉|举报 🐛 |其他

I still encountered a 400/401 error after following the steps above. @dosu

http://192.168.1.13/dify/console/api/refresh-token

Request header

POST /dify/console/api/refresh-token HTTP/1.1
Host: 192.168.1.13
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0
Accept: /
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.13/dify/signin
Content-Type: application/json;utf-8
Origin: http://192.168.1.13
Connection: keep-alive
Cookie: locale=zh-Hans
Priority: u=4
Content-Length: 0

Response header

HTTP/1.1 400 BAD REQUEST
Server: nginx/1.29.3
Date: Sat, 29 Nov 2025 06:08:17 GMT
Content-Type: application/json
Content-Length: 119
Connection: keep-alive
Access-Control-Allow-Origin: http://192.168.1.13
Access-Control-Expose-Headers: X-Env, X-Version
Access-Control-Allow-Credentials: true
Vary: Origin
X-Version: 1.9.1
X-Env: PRODUCTION

cookies

locale:"zh-Hans"

@bumblebee-code-gh commented on GitHub (Nov 29, 2025): > 你已经非常接近正确答案了——这种配置是 Dify 在外部 Nginx 代理后出现 401/400 错误的常见原因。以下是基于最佳实践和已知问题的重点检查清单和故障排除指南： > > 1. **前端构建：** Dify 的前端必须在构建 Docker 镜像之前， > 使用正确的 basePath 和 assetPrefix（例如 `<basePath>` 和 `<assetPrefix>`）进行构建（有时还需要`/dify`在`<assetPrefix>` 中设置）。仅仅在 Dockerfile 中进行设置是不够的；您必须编辑这些文件，然后重新构建镜像。这可以确保静态资源和路由在[[source]](https://github.com/langgenius/dify/discussions/21826)下正常工作。`web/utils/var-basePath.js``web/utils/var.ts``NEXT_PUBLIC_BASE_PATH``/dify` [](https://github.com/langgenius/dify/discussions/21826) > 2. ****后端**环境变量：**所有 > 后端 URL 变量（`CONSOLE_API_URL`，，，，，）必须包含完整的外部 URL 及其子路径（例如，）。这是正确生成链接和身份验证回调所必需的[[来源]](https://github.com/langgenius/dify/discussions/28032)。`APP_API_URL``SERVICE_API_URL``CONSOLE_WEB_URL``APP_WEB_URL``FILES_URL``/dify``http://192.168.1.13:80/dify`[](https://github.com/langgenius/dify/discussions/28032) > 3. **Nginx代理规则：** > > * 对于 API 路由，`/dify`在代理到后端之前，请先去除前缀（就像您所做的那样）。 > * 对于静态资源和前端，保留`/dify`前缀。 > * 始终设置`X-Forwarded-Prefix: /dify`和其他`X-Forwarded-*`标头。 > * 每条路径只使用一个`location`块以避免冲突[[来源]](https://github.com/langgenius/dify/issues/25793)。 > 4. **RESPECT_XFORWARD_HEADERS_ENABLED：**应在后端 > 设置此项，以确保 Dify 尊重来自代理的转发标头[[来源]](https://github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/api/extensions/ext_proxy_fix.py#L5-L9)。`true``.env`[](https://github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/api/extensions/ext_proxy_fix.py#L5-L9) > 5. **CORS 和 Cookie：** > 如果您使用 Cookie 进行身份验证，请将 ` <yourdomain>``CONSOLE_CORS_ALLOW_ORIGINS`和`<yourdomain>` 设置`WEB_API_CORS_ALLOW_ORIGINS`为您的域名（而非 ` `*`<yourdomain>`）。如果您使用子域名，请`COOKIE_DOMAIN`相应地进行设置。请在浏览器开发者工具中检查 Cookie 是否已设置和发送——缺少或被阻止的 Cookie（由于 SameSite 或域名问题）会导致 401/400 错误[[来源]](https://github.com/langgenius/dify/issues/25793)。 > 6. **调试技巧：** > > * 使用浏览器开发者工具检查 API 调用的请求/响应标头和 Cookie。查找缺失的 Cookie、CORS 错误或重定向。 > * 检查后端日志是否存在身份验证或 CSRF 错误。 > * 如果看到 400 `/refresh-token`，通常意味着刷新令牌 cookie 丢失或无效——通常是 cookie 或路径/域不匹配的症状。 > > **概要图：** > > > 如果您按照此清单操作后仍然遇到 401/400 错误，请提供失败 API 调用的请求/响应标头和 Cookie（通过浏览器开发者工具查看），以及任何相关的后端日志消息。这将有助于确定问题是出在代理、Cookie 还是 CORS 上。 > > _回复时只需提及[@dosu](https://go.dosu.dev/dosubot)即可。_ > > 我��得怎么样？[好](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=great_response)|[无关](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=irrelevant_answer)|[错误](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=incorrect_sources)|[冗长](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=too_verbose)|[幻觉](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=hallucination)|[举报 🐛](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=bug_report) |[其他](https://app.dosu.dev/response-feedback/635989e9-6df2-4872-a312-9203dcd2ed3d?feedback_type=other) > > [![与 Dosu 聊天](https://camo.githubusercontent.com/7c571478962a6b8a5d47cac74b6824c75e4f6731bba52377e6007f9150462923/68747470733a2f2f646f73752e6465762f646f73752d636861742d62616467652e737667)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github) [![在光标中打开](https://camo.githubusercontent.com/bdf7dbded65ee585887f47e5fd6fa099ea0933088b4b03d02e83b4def50154d4/68747470733a2f2f646f73752e6465762f646f73752d696e2d637572736f722e737667)](https://cursor.com/link/prompt?text=You%E2%80%99re%20very%20close%E2%80%94this%20setup%20is%20a%20common%20source%20of%20401/400%20errors%20with%20Dify%20behind%20an%20external%20Nginx%20proxy.%20Here%E2%80%99s%20a%20focused%20checklist%20and%20troubleshooting%20guide%20based%20on%20best%20practices%20and%20known%20issues%3A%0A%0A1.%20%2A%2AFrontend%20build%3A%2A%2A%20%20%0A%20%20%20Dify%E2%80%99s%20frontend%20must%20be%20built%20with%20the%20correct%20basePath%20and%20assetPrefix%20%28e.g.%2C%20%60/dify%60%29%20in%20%60web/utils/var-basePath.js%60%20%28and%20sometimes%20%60web/utils/var.ts%60%29%20before%20building%20the%20Docker%20image.%20Just%20setting%20%60NEXT_PUBLIC_BASE_PATH%60%20in%20the%20Dockerfile%20is%20not%20enough%3B%20you%20must%20edit%20these%20files%20and%20then%20rebuild%20the%20image.%20This%20ensures%20static%20assets%20and%20routing%20work%20under%20%60/dify%60%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/discussions/21826%29.%0A%0A2.%20%2A%2ABackend%20environment%20variables%3A%2A%2A%20%20%0A%20%20%20All%20backend%20URL%20variables%20%28%60CONSOLE_API_URL%60%2C%20%60APP_API_URL%60%2C%20%60SERVICE_API_URL%60%2C%20%60CONSOLE_WEB_URL%60%2C%20%60APP_WEB_URL%60%2C%20%60FILES_URL%60%29%20must%20include%20the%20full%20external%20URL%20with%20the%20%60/dify%60%20subpath%20%28e.g.%2C%20%60http%3A//192.168.1.13%3A80/dify%60%29.%20This%20is%20required%20for%20correct%20link%20generation%20and%20authentication%20callbacks%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/discussions/28032%29.%0A%0A3.%20%2A%2ANginx%20proxy%20rules%3A%2A%2A%20%20%0A%20%20%20-%20For%20API%20routes%2C%20strip%20the%20%60/dify%60%20prefix%20before%20proxying%20to%20the%20backend%20%28as%20you%20have%29.%0A%20%20%20-%20For%20static%20assets%20and%20frontend%2C%20keep%20the%20%60/dify%60%20prefix.%0A%20%20%20-%20Always%20set%20%60X-Forwarded-Prefix%3A%20/dify%60%20and%20other%20%60X-Forwarded-%2A%60%20headers.%0A%20%20%20-%20Only%20use%20one%20%60location%60%20block%20per%20path%20to%20avoid%20conflicts%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/issues/25793%29.%0A%0A4.%20%2A%2ARESPECT_XFORWARD_HEADERS_ENABLED%3A%2A%2A%20%20%0A%20%20%20This%20should%20be%20set%20to%20%60true%60%20in%20your%20backend%20%60.env%60%20to%20ensure%20Dify%20respects%20forwarded%20headers%20from%20the%20proxy%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/api/extensions/ext_proxy_fix.py%23L5-L9%29.%0A%0A5.%20%2A%2ACORS%20and%20cookies%3A%2A%2A%20%20%0A%20%20%20If%20you%20use%20cookies%20for%20authentication%2C%20set%20%60CONSOLE_CORS_ALLOW_ORIGINS%60%20and%20%60WEB_API_CORS_ALLOW_ORIGINS%60%20to%20your%20domain%20%28not%20%60%2A%60%29.%20If%20you%E2%80%99re%20using%20subdomains%2C%20set%20%60COOKIE_DOMAIN%60%20accordingly.%20Check%20that%20cookies%20are%20being%20set%20and%20sent%20in%20browser%20DevTools%E2%80%94missing%20or%20blocked%20cookies%20%28due%20to%20SameSite%20or%20domain%20issues%29%20will%20cause%20401/400%20errors%20%5B%5Bsource%5D%5D%28https%3A//github.com/langgenius/dify/issues/25793%29.%0A%0A6.%20%2A%2ADebugging%20tips%3A%2A%2A%20%20%0A%20%20%20-%20Use%20browser%20DevTools%20to%20inspect%20request/response%20headers%20and%20cookies%20for%20API%20calls.%20Look%20for%20missing%20cookies%2C%20CORS%20errors%2C%20or%20redirects.%0A%20%20%20-%20Check%20backend%20logs%20for%20authentication%20or%20CSRF%20errors.%0A%20%20%20-%20If%20you%20see%20400%20on%20%60/refresh-token%60%2C%20it%20often%20means%20the%20refresh%20token%20cookie%20is%20missing%20or%20invalid%E2%80%94usually%20a%20symptom%20of%20a%20cookie%20or%20path/domain%20mismatch.%0A%0A%2A%2ASummary%20diagram%3A%2A%2A%0A%0A%60%60%60mermaid%0Agraph%20LR%0A%20%20%20%20A%5B%22Browser%22%5D%20--%20/dify/console/api/%2A%20--%3E%20B%5B%22External%20Nginx%20%28strips%20/dify%29%22%5D%0A%20%20%20%20B%20--%20/console/api/%2A%20--%3E%20C%5B%22Dify%20Backend%20%28expects%20root%20paths%29%22%5D%0A%20%20%20%20A%20--%20/dify/_next/static/%2A%20--%3E%20B%0A%20%20%20%20B%20--%20/dify/_next/static/%2A%20--%3E%20C%0A%60%60%60%0A%0AIf%20you%20follow%20this%20checklist%20and%20still%20see%20401/400%20errors%2C%20please%20share%20the%20request/response%20headers%20and%20cookies%20for%20a%20failing%20API%20call%20%28from%20browser%20DevTools%29%2C%20and%20any%20relevant%20backend%20log%20messages.%20This%20will%20help%20pinpoint%20whether%20it%E2%80%99s%20a%20proxy%2C%20cookie%2C%20or%20CORS%20issue.) [![加入 Discord](https://camo.githubusercontent.com/7d2066700925db1e370d956834f9ea0e5bc92cecbe84963fbd2a363e45091b4e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6a6f696e2d3538363546323f6c6f676f3d646973636f7264266c6f676f436f6c6f723d7768697465266c6162656c3d)](https://go.dosu.dev/discord-bot) [![分享至 X](https://camo.githubusercontent.com/a8bd7f3fcf3f5e3bd124eee9ae50ae2ac17b40971726665ac2121d48f9aee155/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f582d73686172652d626c61636b)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28927) I still encountered a 400/401 error after following the steps above. [@dosu](https://go.dosu.dev/dosubot) - http://192.168.1.13/dify/console/api/refresh-token Request header > POST /dify/console/api/refresh-token HTTP/1.1 > Host: 192.168.1.13 > User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0 > Accept: */* > Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 > Accept-Encoding: gzip, deflate > Referer: http://192.168.1.13/dify/signin > Content-Type: application/json;utf-8 > Origin: http://192.168.1.13 > Connection: keep-alive > Cookie: locale=zh-Hans > Priority: u=4 > Content-Length: 0 Response header > HTTP/1.1 400 BAD REQUEST > Server: nginx/1.29.3 > Date: Sat, 29 Nov 2025 06:08:17 GMT > Content-Type: application/json > Content-Length: 119 > Connection: keep-alive > Access-Control-Allow-Origin: http://192.168.1.13 > Access-Control-Expose-Headers: X-Env, X-Version > Access-Control-Allow-Credentials: true > Vary: Origin > X-Version: 1.9.1 > X-Env: PRODUCTION cookies > locale:"zh-Hans" <img width="1920" height="1040" alt="Image" src="https://github.com/user-attachments/assets/aa479f54-fea2-4309-bbc7-8529b6e089bd" /> <img width="1920" height="1040" alt="Image" src="https://github.com/user-attachments/assets/5409d7ee-3c36-4a7e-a107-3ed9f35626d3" />

yindo commented

2026-02-21 20:08:27 -05:00

@dosubot[bot] commented on GitHub (Nov 29, 2025):

你的配置已经非常接近最佳实践，但根据你提供的请求/响应头和浏览器截图，核心问题是认证 Cookie（如 refresh_token、access_token、csrf_token）没有被设置或发送，导致 /refresh-token 返回 400，其他 API 返回 401。这通常不是 API 路径或 Nginx 转发的问题，而是 Cookie 没有正确下发或被浏览器阻止。

请按以下步骤逐项排查：

确认 Set-Cookie 响应
登录时（POST /dify/console/api/login），请在浏览器开发者工具 Network 面板中，点开 login 请求，查看 Response Headers 里是否有 Set-Cookie 字段（应该有 refresh_token、access_token、csrf_token）。如果没有，说明后端没有正确下发 Cookie，通常是 domain/path 配置问题。
检查 .env 关键配置
- COOKIE_DOMAIN 必须为空或与你访问的域名一致（如 192.168.1.13），不要带端口或协议，不能是 localhost。
- CONSOLE_CORS_ALLOW_ORIGINS 和 WEB_API_CORS_ALLOW_ORIGINS 必须精确设置为 http://192.168.1.13（不能是 *），否则浏览器不会带 Cookie。
- RESPECT_XFORWARD_HEADERS_ENABLED 必须为 true。
- CONSOLE_API_URL、CONSOLE_WEB_URL 等所有 URL 必须带 /dify 前缀且和实际访问一致。
前端构建
仅设置 ENV NEXT_PUBLIC_BASE_PATH=/dify 不够，必须在 web/utils/var-basePath.js 和 web/utils/var.ts 里手动写死 basePath/assetPrefix 为 /dify，然后重新 build 前端镜像（docker build --no-cache），否则静态资源和 API 路径会错乱，Cookie 也可能丢失。参考
Nginx 配置
- API 路由 strip 掉 /dify 前缀，静态资源保留。
- proxy_set_header Host $host; 建议改为 proxy_set_header Host $http_host; 并确保 proxy_http_version 1.1。
- 不要有重复的 location 块，避免冲突。
- 不要在静态资源 location 里 rewrite 路径。
浏览器端检查
- 登录后，浏览器 Application/Cookies 面板里，应该能看到 refresh_token、access_token、csrf_token。如果没有，说明 Cookie 没有被正确下发或被浏览器拦截。
- 检查是否有 SameSite、Secure、Domain 警告（比如“此 Cookie 被阻止”）。
- 清空浏览器缓存和 Cookie 后重试，避免老的 Cookie 干扰。
后端日志
- 查看 Dify 后端日志，确认 login 和 refresh-token 请求时是否有 “No refresh token provided” 或 CSRF 相关报错。
常见原因总结
- COOKIE_DOMAIN 配置不对（为空或与实际访问域名不符）。
- CORS 配置不对（不是精确域名）。
- 前端没有正确 build，basePath/assetPrefix 没有写死。
- Nginx 配置 strip/rewrite 错误或未转发 Set-Cookie。
- 浏览器阻止 Cookie（SameSite、Secure、Domain 问题）。

请重点提供：

登录接口（/dify/console/api/login）响应头里的 Set-Cookie 内容（截图或文本）。
.env 里 COOKIE_DOMAIN、CONSOLE_CORS_ALLOW_ORIGINS、WEB_API_CORS_ALLOW_ORIGINS 的实际值。
登录后浏览器 Cookie 面板里是否有 refresh_token、access_token、csrf_token。
后端日志中 refresh-token 相关报错。

这样可以精准定位是 Cookie 没有下发、被拦截，还是配置问题。
如需进一步排查，可加临时 header（如 add_header X-Debug-Test 1;）确认 Nginx 配置是否生效。

参考：Dify Cookie 设置源码
相关讨论：Nginx/Cookie 问题排查

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Nov 29, 2025):  你的配置已经非常接近最佳实践，但根据你提供的请求/响应头和浏览器截图，核心问题是**认证 Cookie（如 refresh_token、access_token、csrf_token）没有被设置或发送**，导致 /refresh-token 返回 400，其他 API 返回 401。这通常不是 API 路径或 Nginx 转发的问题，而是 Cookie 没有正确下发或被浏览器阻止。请按以下步骤逐项排查： 1. **确认 Set-Cookie 响应** 登录时（POST /dify/console/api/login），请在浏览器开发者工具 Network 面板中，点开 login 请求，查看 Response Headers 里是否有 Set-Cookie 字段（应该有 refresh_token、access_token、csrf_token）。如果没有，说明后端没有正确下发 Cookie，通常是 domain/path 配置问题。 2. **检查 .env 关键配置** - COOKIE_DOMAIN 必须为空或与你访问的域名一致（如 192.168.1.13），不要带端口或协议，不能是 localhost。 - CONSOLE_CORS_ALLOW_ORIGINS 和 WEB_API_CORS_ALLOW_ORIGINS 必须精确设置为 http://192.168.1.13（不能是 *），否则浏览器不会带 Cookie。 - RESPECT_XFORWARD_HEADERS_ENABLED 必须为 true。 - CONSOLE_API_URL、CONSOLE_WEB_URL 等所有 URL 必须带 /dify 前缀且和实际访问一致。 3. **前端构建** 仅设置 ENV NEXT_PUBLIC_BASE_PATH=/dify 不够，必须在 web/utils/var-basePath.js 和 web/utils/var.ts 里手动写死 basePath/assetPrefix 为 /dify，然后重新 build 前端镜像（docker build --no-cache），否则静态资源和 API 路径会错乱，Cookie 也可能丢失。[参考](https://github.com/langgenius/dify/discussions/21826) 4. **Nginx 配置** - API 路由 strip 掉 /dify 前缀，静态资源保留。 - proxy_set_header Host $host; 建议改为 proxy_set_header Host $http_host; 并确保 proxy_http_version 1.1。 - 不要有重复的 location 块，避免冲突。 - 不要在静态资源 location 里 rewrite 路径。 5. **浏览器端检查** - 登录后，浏览器 Application/Cookies 面板里，应该能看到 refresh_token、access_token、csrf_token。如果没有，说明 Cookie 没有被正确下发或被浏览器拦截。 - 检查是否有 SameSite、Secure、Domain 警告（比如“此 Cookie 被阻止”）。 - 清空浏览器缓存和 Cookie 后重试，避免老的 Cookie 干扰。 6. **后端日志** - 查看 Dify 后端日志，确认 login 和 refresh-token 请求时是否有 “No refresh token provided” 或 CSRF 相关报错。 7. **常见原因总结** - COOKIE_DOMAIN 配置不对（为空或与实际访问域名不符）。 - CORS 配置不对（不是精确域名）。 - 前端没有正确 build，basePath/assetPrefix 没有写死。 - Nginx 配置 strip/rewrite 错误或未转发 Set-Cookie。 - 浏览器阻止 Cookie（SameSite、Secure、Domain 问题）。 --- **请重点提供：** - 登录接口（/dify/console/api/login）响应头里的 Set-Cookie 内容（截图或文本）。 - .env 里 COOKIE_DOMAIN、CONSOLE_CORS_ALLOW_ORIGINS、WEB_API_CORS_ALLOW_ORIGINS 的实际值。 - 登录后浏览器 Cookie 面板里是否有 refresh_token、access_token、csrf_token。 - 后端日志中 refresh-token 相关报错。这样可以精准定位是 Cookie 没有下发、被拦截，还是配置问题。如需进一步排查，可加临时 header（如 add_header X-Debug-Test 1;）确认 Nginx 配置是否生效。参考：[Dify Cookie 设置源码](https://github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/api/libs/token.py#L33-L139) 相关讨论：[Nginx/Cookie 问题排查](https://github.com/langgenius/dify/issues/25793#issuecomment-3298775664)  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- How did I do? [Good](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=other) [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github) [![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=%E4%BD%A0%E7%9A%84%E9%85%8D%E7%BD%AE%E5%B7%B2%E7%BB%8F%E9%9D%9E%E5%B8%B8%E6%8E%A5%E8%BF%91%E6%9C%80%E4%BD%B3%E5%AE%9E%E8%B7%B5%EF%BC%8C%E4%BD%86%E6%A0%B9%E6%8D%AE%E4%BD%A0%E6%8F%90%E4%BE%9B%E7%9A%84%E8%AF%B7%E6%B1%82/%E5%93%8D%E5%BA%94%E5%A4%B4%E5%92%8C%E6%B5%8F%E8%A7%88%E5%99%A8%E6%88%AA%E5%9B%BE%EF%BC%8C%E6%A0%B8%E5%BF%83%E9%97%AE%E9%A2%98%E6%98%AF%2A%2A%E8%AE%A4%E8%AF%81%20Cookie%EF%BC%88%E5%A6%82%20refresh_token%E3%80%81access_token%E3%80%81csrf_token%EF%BC%89%E6%B2%A1%E6%9C%89%E8%A2%AB%E8%AE%BE%E7%BD%AE%E6%88%96%E5%8F%91%E9%80%81%2A%2A%EF%BC%8C%E5%AF%BC%E8%87%B4%20/refresh-token%20%E8%BF%94%E5%9B%9E%20400%EF%BC%8C%E5%85%B6%E4%BB%96%20API%20%E8%BF%94%E5%9B%9E%20401%E3%80%82%E8%BF%99%E9%80%9A%E5%B8%B8%E4%B8%8D%E6%98%AF%20API%20%E8%B7%AF%E5%BE%84%E6%88%96%20Nginx%20%E8%BD%AC%E5%8F%91%E7%9A%84%E9%97%AE%E9%A2%98%EF%BC%8C%E8%80%8C%E6%98%AF%20Cookie%20%E6%B2%A1%E6%9C%89%E6%AD%A3%E7%A1%AE%E4%B8%8B%E5%8F%91%E6%88%96%E8%A2%AB%E6%B5%8F%E8%A7%88%E5%99%A8%E9%98%BB%E6%AD%A2%E3%80%82%0A%0A%E8%AF%B7%E6%8C%89%E4%BB%A5%E4%B8%8B%E6%AD%A5%E9%AA%A4%E9%80%90%E9%A1%B9%E6%8E%92%E6%9F%A5%EF%BC%9A%0A%0A1.%20%2A%2A%E7%A1%AE%E8%AE%A4%20Set-Cookie%20%E5%93%8D%E5%BA%94%2A%2A%20%20%0A%20%20%20%E7%99%BB%E5%BD%95%E6%97%B6%EF%BC%88POST%20/dify/console/api/login%EF%BC%89%EF%BC%8C%E8%AF%B7%E5%9C%A8%E6%B5%8F%E8%A7%88%E5%99%A8%E5%BC%80%E5%8F%91%E8%80%85%E5%B7%A5%E5%85%B7%20Network%20%E9%9D%A2%E6%9D%BF%E4%B8%AD%EF%BC%8C%E7%82%B9%E5%BC%80%20login%20%E8%AF%B7%E6%B1%82%EF%BC%8C%E6%9F%A5%E7%9C%8B%20Response%20Headers%20%E9%87%8C%E6%98%AF%E5%90%A6%E6%9C%89%20Set-Cookie%20%E5%AD%97%E6%AE%B5%EF%BC%88%E5%BA%94%E8%AF%A5%E6%9C%89%20refresh_token%E3%80%81access_token%E3%80%81csrf_token%EF%BC%89%E3%80%82%E5%A6%82%E6%9E%9C%E6%B2%A1%E6%9C%89%EF%BC%8C%E8%AF%B4%E6%98%8E%E5%90%8E%E7%AB%AF%E6%B2%A1%E6%9C%89%E6%AD%A3%E7%A1%AE%E4%B8%8B%E5%8F%91%20Cookie%EF%BC%8C%E9%80%9A%E5%B8%B8%E6%98%AF%20domain/path%20%E9%85%8D%E7%BD%AE%E9%97%AE%E9%A2%98%E3%80%82%0A%0A2.%20%2A%2A%E6%A3%80%E6%9F%A5%20.env%20%E5%85%B3%E9%94%AE%E9%85%8D%E7%BD%AE%2A%2A%20%20%0A%20%20%20-%20COOKIE_DOMAIN%20%E5%BF%85%E9%A1%BB%E4%B8%BA%E7%A9%BA%E6%88%96%E4%B8%8E%E4%BD%A0%E8%AE%BF%E9%97%AE%E7%9A%84%E5%9F%9F%E5%90%8D%E4%B8%80%E8%87%B4%EF%BC%88%E5%A6%82%20192.168.1.13%EF%BC%89%EF%BC%8C%E4%B8%8D%E8%A6%81%E5%B8%A6%E7%AB%AF%E5%8F%A3%E6%88%96%E5%8D%8F%E8%AE%AE%EF%BC%8C%E4%B8%8D%E8%83%BD%E6%98%AF%20localhost%E3%80%82%0A%20%20%20-%20CONSOLE_CORS_ALLOW_ORIGINS%20%E5%92%8C%20WEB_API_CORS_ALLOW_ORIGINS%20%E5%BF%85%E9%A1%BB%E7%B2%BE%E7%A1%AE%E8%AE%BE%E7%BD%AE%E4%B8%BA%20http%3A//192.168.1.13%EF%BC%88%E4%B8%8D%E8%83%BD%E6%98%AF%20%2A%EF%BC%89%EF%BC%8C%E5%90%A6%E5%88%99%E6%B5%8F%E8%A7%88%E5%99%A8%E4%B8%8D%E4%BC%9A%E5%B8%A6%20Cookie%E3%80%82%0A%20%20%20-%20RESPECT_XFORWARD_HEADERS_ENABLED%20%E5%BF%85%E9%A1%BB%E4%B8%BA%20true%E3%80%82%0A%20%20%20-%20CONSOLE_API_URL%E3%80%81CONSOLE_WEB_URL%20%E7%AD%89%E6%89%80%E6%9C%89%20URL%20%E5%BF%85%E9%A1%BB%E5%B8%A6%20/dify%20%E5%89%8D%E7%BC%80%E4%B8%94%E5%92%8C%E5%AE%9E%E9%99%85%E8%AE%BF%E9%97%AE%E4%B8%80%E8%87%B4%E3%80%82%0A%0A3.%20%2A%2A%E5%89%8D%E7%AB%AF%E6%9E%84%E5%BB%BA%2A%2A%20%20%0A%20%20%20%E4%BB%85%E8%AE%BE%E7%BD%AE%20ENV%20NEXT_PUBLIC_BASE_PATH%3D/dify%20%E4%B8%8D%E5%A4%9F%EF%BC%8C%E5%BF%85%E9%A1%BB%E5%9C%A8%20web/utils/var-basePath.js%20%E5%92%8C%20web/utils/var.ts%20%E9%87%8C%E6%89%8B%E5%8A%A8%E5%86%99%E6%AD%BB%20basePath/assetPrefix%20%E4%B8%BA%20/dify%EF%BC%8C%E7%84%B6%E5%90%8E%E9%87%8D%E6%96%B0%20build%20%E5%89%8D%E7%AB%AF%E9%95%9C%E5%83%8F%EF%BC%88docker%20build%20--no-cache%EF%BC%89%EF%BC%8C%E5%90%A6%E5%88%99%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%E5%92%8C%20API%20%E8%B7%AF%E5%BE%84%E4%BC%9A%E9%94%99%E4%B9%B1%EF%BC%8CCookie%20%E4%B9%9F%E5%8F%AF%E8%83%BD%E4%B8%A2%E5%A4%B1%E3%80%82%5B%E5%8F%82%E8%80%83%5D%28https%3A//github.com/langgenius/dify/discussions/21826%29%0A%0A4.%20%2A%2ANginx%20%E9%85%8D%E7%BD%AE%2A%2A%20%20%0A%20%20%20-%20API%20%E8%B7%AF%E7%94%B1%20strip%20%E6%8E%89%20/dify%20%E5%89%8D%E7%BC%80%EF%BC%8C%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%E4%BF%9D%E7%95%99%E3%80%82%0A%20%20%20-%20proxy_set_header%20Host%20%24host%3B%20%E5%BB%BA%E8%AE%AE%E6%94%B9%E4%B8%BA%20proxy_set_header%20Host%20%24http_host%3B%20%E5%B9%B6%E7%A1%AE%E4%BF%9D%20proxy_http_version%201.1%E3%80%82%0A%20%20%20-%20%E4%B8%8D%E8%A6%81%E6%9C%89%E9%87%8D%E5%A4%8D%E7%9A%84%20location%20%E5%9D%97%EF%BC%8C%E9%81%BF%E5%85%8D%E5%86%B2%E7%AA%81%E3%80%82%0A%20%20%20-%20%E4%B8%8D%E8%A6%81%E5%9C%A8%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%20location%20%E9%87%8C%20rewrite%20%E8%B7%AF%E5%BE%84%E3%80%82%0A%0A5.%20%2A%2A%E6%B5%8F%E8%A7%88%E5%99%A8%E7%AB%AF%E6%A3%80%E6%9F%A5%2A%2A%20%20%0A%20%20%20-%20%E7%99%BB%E5%BD%95%E5%90%8E%EF%BC%8C%E6%B5%8F%E8%A7%88%E5%99%A8%20Application/Cookies%20%E9%9D%A2%E6%9D%BF%E9%87%8C%EF%BC%8C%E5%BA%94%E8%AF%A5%E8%83%BD%E7%9C%8B%E5%88%B0%20refresh_token%E3%80%81access_token%E3%80%81csrf_token%E3%80%82%E5%A6%82%E6%9E%9C%E6%B2%A1%E6%9C%89%EF%BC%8C%E8%AF%B4%E6%98%8E%20Cookie%20%E6%B2%A1%E6%9C%89%E8%A2%AB%E6%AD%A3%E7%A1%AE%E4%B8%8B%E5%8F%91%E6%88%96%E8%A2%AB%E6%B5%8F%E8%A7%88%E5%99%A8%E6%8B%A6%E6%88%AA%E3%80%82%0A%20%20%20-%20%E6%A3%80%E6%9F%A5%E6%98%AF%E5%90%A6%E6%9C%89%20SameSite%E3%80%81Secure%E3%80%81Domain%20%E8%AD%A6%E5%91%8A%EF%BC%88%E6%AF%94%E5%A6%82%E2%80%9C%E6%AD%A4%20Cookie%20%E8%A2%AB%E9%98%BB%E6%AD%A2%E2%80%9D%EF%BC%89%E3%80%82%0A%20%20%20-%20%E6%B8%85%E7%A9%BA%E6%B5%8F%E8%A7%88%E5%99%A8%E7%BC%93%E5%AD%98%E5%92%8C%20Cookie%20%E5%90%8E%E9%87%8D%E8%AF%95%EF%BC%8C%E9%81%BF%E5%85%8D%E8%80%81%E7%9A%84%20Cookie%20%E5%B9%B2%E6%89%B0%E3%80%82%0A%0A6.%20%2A%2A%E5%90%8E%E7%AB%AF%E6%97%A5%E5%BF%97%2A%2A%20%20%0A%20%20%20-%20%E6%9F%A5%E7%9C%8B%20Dify%20%E5%90%8E%E7%AB%AF%E6%97%A5%E5%BF%97%EF%BC%8C%E7%A1%AE%E8%AE%A4%20login%20%E5%92%8C%20refresh-token%20%E8%AF%B7%E6%B1%82%E6%97%B6%E6%98%AF%E5%90%A6%E6%9C%89%20%E2%80%9CNo%20refresh%20token%20provided%E2%80%9D%20%E6%88%96%20CSRF%20%E7%9B%B8%E5%85%B3%E6%8A%A5%E9%94%99%E3%80%82%0A%0A7.%20%2A%2A%E5%B8%B8%E8%A7%81%E5%8E%9F%E5%9B%A0%E6%80%BB%E7%BB%93%2A%2A%20%20%0A%20%20%20-%20COOKIE_DOMAIN%20%E9%85%8D%E7%BD%AE%E4%B8%8D%E5%AF%B9%EF%BC%88%E4%B8%BA%E7%A9%BA%E6%88%96%E4%B8%8E%E5%AE%9E%E9%99%85%E8%AE%BF%E9%97%AE%E5%9F%9F%E5%90%8D%E4%B8%8D%E7%AC%A6%EF%BC%89%E3%80%82%0A%20%20%20-%20CORS%20%E9%85%8D%E7%BD%AE%E4%B8%8D%E5%AF%B9%EF%BC%88%E4%B8%8D%E6%98%AF%E7%B2%BE%E7%A1%AE%E5%9F%9F%E5%90%8D%EF%BC%89%E3%80%82%0A%20%20%20-%20%E5%89%8D%E7%AB%AF%E6%B2%A1%E6%9C%89%E6%AD%A3%E7%A1%AE%20build%EF%BC%8CbasePath/assetPrefix%20%E6%B2%A1%E6%9C%89%E5%86%99%E6%AD%BB%E3%80%82%0A%20%20%20-%20Nginx%20%E9%85%8D%E7%BD%AE%20strip/rewrite%20%E9%94%99%E8%AF%AF%E6%88%96%E6%9C%AA%E8%BD%AC%E5%8F%91%20Set-Cookie%E3%80%82%0A%20%20%20-%20%E6%B5%8F%E8%A7%88%E5%99%A8%E9%98%BB%E6%AD%A2%20Cookie%EF%BC%88SameSite%E3%80%81Secure%E3%80%81Domain%20%E9%97%AE%E9%A2%98%EF%BC%89%E3%80%82%0A%0A---%0A%0A%2A%2A%E8%AF%B7%E9%87%8D%E7%82%B9%E6%8F%90%E4%BE%9B%EF%BC%9A%2A%2A%0A-%20%E7%99%BB%E5%BD%95%E6%8E%A5%E5%8F%A3%EF%BC%88/dify/console/api/login%EF%BC%89%E5%93%8D%E5%BA%94%E5%A4%B4%E9%87%8C%E7%9A%84%20Set-Cookie%20%E5%86%85%E5%AE%B9%EF%BC%88%E6%88%AA%E5%9B%BE%E6%88%96%E6%96%87%E6%9C%AC%EF%BC%89%E3%80%82%0A-%20.env%20%E9%87%8C%20COOKIE_DOMAIN%E3%80%81CONSOLE_CORS_ALLOW_ORIGINS%E3%80%81WEB_API_CORS_ALLOW_ORIGINS%20%E7%9A%84%E5%AE%9E%E9%99%85%E5%80%BC%E3%80%82%0A-%20%E7%99%BB%E5%BD%95%E5%90%8E%E6%B5%8F%E8%A7%88%E5%99%A8%20Cookie%20%E9%9D%A2%E6%9D%BF%E9%87%8C%E6%98%AF%E5%90%A6%E6%9C%89%20refresh_token%E3%80%81access_token%E3%80%81csrf_token%E3%80%82%0A-%20%E5%90%8E%E7%AB%AF%E6%97%A5%E5%BF%97%E4%B8%AD%20refresh-token%20%E7%9B%B8%E5%85%B3%E6%8A%A5%E9%94%99%E3%80%82%0A%0A%E8%BF%99%E6%A0%B7%E5%8F%AF%E4%BB%A5%E7%B2%BE%E5%87%86%E5%AE%9A%E4%BD%8D%E6%98%AF%20Cookie%20%E6%B2%A1%E6%9C%89%E4%B8%8B%E5%8F%91%E3%80%81%E8%A2%AB%E6%8B%A6%E6%88%AA%EF%BC%8C%E8%BF%98%E6%98%AF%E9%85%8D%E7%BD%AE%E9%97%AE%E9%A2%98%E3%80%82%20%20%0A%E5%A6%82%E9%9C%80%E8%BF%9B%E4%B8%80%E6%AD%A5%E6%8E%92%E6%9F%A5%EF%BC%8C%E5%8F%AF%E5%8A%A0%E4%B8%B4%E6%97%B6%20header%EF%BC%88%E5%A6%82%20add_header%20X-Debug-Test%201%3B%EF%BC%89%E7%A1%AE%E8%AE%A4%20Nginx%20%E9%85%8D%E7%BD%AE%E6%98%AF%E5%90%A6%E7%94%9F%E6%95%88%E3%80%82%0A%0A%E5%8F%82%E8%80%83%EF%BC%9A%5BDify%20Cookie%20%E8%AE%BE%E7%BD%AE%E6%BA%90%E7%A0%81%5D%28https%3A//github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/api/libs/token.py%23L33-L139%29%20%20%0A%E7%9B%B8%E5%85%B3%E8%AE%A8%E8%AE%BA%EF%BC%9A%5BNginx/Cookie%20%E9%97%AE%E9%A2%98%E6%8E%92%E6%9F%A5%5D%28https%3A//github.com/langgenius/dify/issues/25793%23issuecomment-3298775664%29) [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28927)

yindo commented

2026-02-21 20:08:27 -05:00

@bumblebee-code-gh commented on GitHub (Nov 29, 2025):

你的配置已经非常接近最佳实践，但根据你提供的请求/响应头和浏览器截图，核心问题是认证 Cookie（如 refresh_token、access_token、csrf_token）没有被设置或发送，导致 /refresh-token 返回 400，其他 API 返回 401。这通常不是 API 路径或 Nginx 转发的问题，而是 Cookie 没有正确下发或被浏览器阻止。

请按以下步骤逐项排查：

确认 Set-Cookie 响应
登录时（POST /dify/console/api/login），请在浏览器开发者工具 Network 面板中，点开 login 请求，查看 Response Headers 里是否有 Set-Cookie 字段（应该有 refresh_token、access_token、csrf_token）。如果没有，说明后端没有正确下发 Cookie，通常是 domain/path 配置问题。

检查 .env 关键配置

COOKIE_DOMAIN 必须为空或与你访问的域名一致（如 192.168.1.13），不要带端口或协议，不能是 localhost。

CONSOLE_CORS_ALLOW_ORIGINS 和 WEB_API_CORS_ALLOW_ORIGINS 必须精确设置为 http://192.168.1.13（不能是 *），否则浏览器不会带 Cookie。

RESPECT_XFORWARD_HEADERS_ENABLED 必须为 true。

CONSOLE_API_URL、CONSOLE_WEB_URL 等所有 URL 必须带 /dify 前缀且和实际访问一致。

前端构建
仅设置 ENV NEXT_PUBLIC_BASE_PATH=/dify 不够，必须在 web/utils/var-basePath.js 和 web/utils/var.ts 里手动写死 basePath/assetPrefix 为 /dify，然后重新 build 前端镜像（docker build --no-cache），否则静态资源和 API 路径会错乱，Cookie 也可能丢失。参考

Nginx 配置

API 路由 strip 掉 /dify 前缀，静态资源保留。

proxy_set_header Host $host; 建议改为 proxy_set_header Host $http_host; 并确保 proxy_http_version 1.1。

不要有重复的 location 块，避免冲突。

不要在静态资源 location 里 rewrite 路径。

浏览器端检查

登录后，浏览器 Application/Cookies 面板里，应该能看到 refresh_token、access_token、csrf_token。如果没有，说明 Cookie 没有被正确下发或被浏览器拦截。

检查是否有 SameSite、Secure、Domain 警告（比如“此 Cookie 被阻止”）。

清空浏览器缓存和 Cookie 后重试，避免老的 Cookie 干扰。

后端日志

查看 Dify 后端日志，确认 login 和 refresh-token 请求时是否有 “No refresh token provided” 或 CSRF 相关报错。

常见原因总结

COOKIE_DOMAIN 配置不对（为空或与实际访问域名不符）。

CORS 配置不对（不是精确域名）。

前端没有正确 build，basePath/assetPrefix 没有写死。

Nginx 配置 strip/rewrite 错误或未转发 Set-Cookie。

浏览器阻止 Cookie（SameSite、Secure、Domain 问题）。

请重点提供：

登录接口（/dify/console/api/login）响应头里的 Set-Cookie 内容（截图或文本）。

.env 里 COOKIE_DOMAIN、CONSOLE_CORS_ALLOW_ORIGINS、WEB_API_CORS_ALLOW_ORIGINS 的实际值。

登录后浏览器 Cookie 面板里是否有 refresh_token、access_token、csrf_token。

后端日志中 refresh-token 相关报错。

这样可以精准定位是 Cookie 没有下发、被拦截，还是配置问题。如需进一步排查，可加临时 header（如 add_header X-Debug-Test 1;）确认 Nginx 配置是否生效。

参考：Dify Cookie 设置源码相关讨论：Nginx/Cookie 问题排查

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

I'm sorry, I still don't quite understand the operation you mentioned. Let's take it step by step.

My expectation is to deploy Dify and gateway Nginx using Docker on a server with an IP address of 192.168.13.1. Since the server only opens port 80 for the gateway Nginx to use, the Docker address is 172.21.240.1. I want to use this gateway Nginx proxy to run the Dify service in Docker for external access, with the access address being http://192.168.13.1/dify .

Firstly, I did not find the web/tils/var-basePath.js file in the source code of Dify version 1.9.1. I found that it had already been removed and refactored in version 1.8.1, and new fixes were found in the next-config.js and var.ts files.

Therefore, when building the frontend image, do I only need to modify the dify/web/Dockerfile file? The modifications are as follows:

Am I following the correct steps? @dosu

@bumblebee-code-gh commented on GitHub (Nov 29, 2025): > 你的配置已经非常接近最佳实践，但根据你提供的请求/响应头和浏览器截图，核心问题是**认证 Cookie（如 refresh_token、access_token、csrf_token）没有被设置或发送**，导致 /refresh-token 返回 400，其他 API 返回 401。这通常不是 API 路径或 Nginx 转发的问题，而是 Cookie 没有正确下发或被浏览器阻止。 > > 请按以下步骤逐项排查： > > 1. **确认 Set-Cookie 响应** > 登录时（POST /dify/console/api/login），请在浏览器开发者工具 Network 面板中，点开 login 请求，查看 Response Headers 里是否有 Set-Cookie 字段（应该有 refresh_token、access_token、csrf_token）。如果没有，说明后端没有正确下发 Cookie，通常是 domain/path 配置问题。 > 2. **检查 .env 关键配置** > > * COOKIE_DOMAIN 必须为空或与你访问的域名一致（如 192.168.1.13），不要带端口或协议，不能是 localhost。 > * CONSOLE_CORS_ALLOW_ORIGINS 和 WEB_API_CORS_ALLOW_ORIGINS 必须精确设置为 [http://192.168.1.13（不能是](http://192.168.1.13%EF%BC%88%E4%B8%8D%E8%83%BD%E6%98%AF) *），否则浏览器不会带 Cookie。 > * RESPECT_XFORWARD_HEADERS_ENABLED 必须为 true。 > * CONSOLE_API_URL、CONSOLE_WEB_URL 等所有 URL 必须带 /dify 前缀且和实际访问一致。 > 3. **前端构建** > 仅设置 ENV NEXT_PUBLIC_BASE_PATH=/dify 不够，必须在 web/utils/var-basePath.js 和 web/utils/var.ts 里手动写死 basePath/assetPrefix 为 /dify，然后重新 build 前端镜像（docker build --no-cache），否则静态资源和 API 路径会错乱，Cookie 也可能丢失。[参考](https://github.com/langgenius/dify/discussions/21826) > 4. **Nginx 配置** > > * API 路由 strip 掉 /dify 前缀，静态资源保留。 > * proxy_set_header Host $host; 建议改为 proxy_set_header Host $http_host; 并确保 proxy_http_version 1.1。 > * 不要有重复的 location 块，避免冲突。 > * 不要在静态资源 location 里 rewrite 路径。 > 5. **浏览器端检查** > > * 登录后，浏览器 Application/Cookies 面板里，应该能看到 refresh_token、access_token、csrf_token。如果没有，说明 Cookie 没有被正确下发或被浏览器拦截。 > * 检查是否有 SameSite、Secure、Domain 警告（比如“此 Cookie 被阻止”）。 > * 清空浏览器缓存和 Cookie 后重试，避免老的 Cookie 干扰。 > 6. **后端日志** > > * 查看 Dify 后端日志，确认 login 和 refresh-token 请求时是否有 “No refresh token provided” 或 CSRF 相关报错。 > 7. **常见原因总结** > > * COOKIE_DOMAIN 配置不对（为空或与实际访问域名不符）。 > * CORS 配置不对（不是精确域名）。 > * 前端没有正确 build，basePath/assetPrefix 没有写死。 > * Nginx 配置 strip/rewrite 错误或未转发 Set-Cookie。 > * 浏览器阻止 Cookie（SameSite、Secure、Domain 问题）。 > > **请重点提供：** > > * 登录接口（/dify/console/api/login）响应头里的 Set-Cookie 内容（截图或文本）。 > * .env 里 COOKIE_DOMAIN、CONSOLE_CORS_ALLOW_ORIGINS、WEB_API_CORS_ALLOW_ORIGINS 的实际值。 > * 登录后浏览器 Cookie 面板里是否有 refresh_token、access_token、csrf_token。 > * 后端日志中 refresh-token 相关报错。 > > 这样可以精准定位是 Cookie 没有下发、被拦截，还是配置问题。如需进一步排查，可加临时 header（如 add_header X-Debug-Test 1;）确认 Nginx 配置是否生效。 > > 参考：[Dify Cookie 设置源码](https://github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/api/libs/token.py#L33-L139) 相关讨论：[Nginx/Cookie 问题排查](https://github.com/langgenius/dify/issues/25793#issuecomment-3298775664) > > _To reply, just mention [@dosu](https://go.dosu.dev/dosubot)._ > > How did I do? [Good](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/5999fc4b-594b-4724-b14b-196b5b4f610a?feedback_type=other) > > [![Chat with Dosu](https://camo.githubusercontent.com/7c571478962a6b8a5d47cac74b6824c75e4f6731bba52377e6007f9150462923/68747470733a2f2f646f73752e6465762f646f73752d636861742d62616467652e737667)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github) [![Open in Cursor](https://camo.githubusercontent.com/bdf7dbded65ee585887f47e5fd6fa099ea0933088b4b03d02e83b4def50154d4/68747470733a2f2f646f73752e6465762f646f73752d696e2d637572736f722e737667)](https://cursor.com/link/prompt?text=%E4%BD%A0%E7%9A%84%E9%85%8D%E7%BD%AE%E5%B7%B2%E7%BB%8F%E9%9D%9E%E5%B8%B8%E6%8E%A5%E8%BF%91%E6%9C%80%E4%BD%B3%E5%AE%9E%E8%B7%B5%EF%BC%8C%E4%BD%86%E6%A0%B9%E6%8D%AE%E4%BD%A0%E6%8F%90%E4%BE%9B%E7%9A%84%E8%AF%B7%E6%B1%82/%E5%93%8D%E5%BA%94%E5%A4%B4%E5%92%8C%E6%B5%8F%E8%A7%88%E5%99%A8%E6%88%AA%E5%9B%BE%EF%BC%8C%E6%A0%B8%E5%BF%83%E9%97%AE%E9%A2%98%E6%98%AF%2A%2A%E8%AE%A4%E8%AF%81%20Cookie%EF%BC%88%E5%A6%82%20refresh_token%E3%80%81access_token%E3%80%81csrf_token%EF%BC%89%E6%B2%A1%E6%9C%89%E8%A2%AB%E8%AE%BE%E7%BD%AE%E6%88%96%E5%8F%91%E9%80%81%2A%2A%EF%BC%8C%E5%AF%BC%E8%87%B4%20/refresh-token%20%E8%BF%94%E5%9B%9E%20400%EF%BC%8C%E5%85%B6%E4%BB%96%20API%20%E8%BF%94%E5%9B%9E%20401%E3%80%82%E8%BF%99%E9%80%9A%E5%B8%B8%E4%B8%8D%E6%98%AF%20API%20%E8%B7%AF%E5%BE%84%E6%88%96%20Nginx%20%E8%BD%AC%E5%8F%91%E7%9A%84%E9%97%AE%E9%A2%98%EF%BC%8C%E8%80%8C%E6%98%AF%20Cookie%20%E6%B2%A1%E6%9C%89%E6%AD%A3%E7%A1%AE%E4%B8%8B%E5%8F%91%E6%88%96%E8%A2%AB%E6%B5%8F%E8%A7%88%E5%99%A8%E9%98%BB%E6%AD%A2%E3%80%82%0A%0A%E8%AF%B7%E6%8C%89%E4%BB%A5%E4%B8%8B%E6%AD%A5%E9%AA%A4%E9%80%90%E9%A1%B9%E6%8E%92%E6%9F%A5%EF%BC%9A%0A%0A1.%20%2A%2A%E7%A1%AE%E8%AE%A4%20Set-Cookie%20%E5%93%8D%E5%BA%94%2A%2A%20%20%0A%20%20%20%E7%99%BB%E5%BD%95%E6%97%B6%EF%BC%88POST%20/dify/console/api/login%EF%BC%89%EF%BC%8C%E8%AF%B7%E5%9C%A8%E6%B5%8F%E8%A7%88%E5%99%A8%E5%BC%80%E5%8F%91%E8%80%85%E5%B7%A5%E5%85%B7%20Network%20%E9%9D%A2%E6%9D%BF%E4%B8%AD%EF%BC%8C%E7%82%B9%E5%BC%80%20login%20%E8%AF%B7%E6%B1%82%EF%BC%8C%E6%9F%A5%E7%9C%8B%20Response%20Headers%20%E9%87%8C%E6%98%AF%E5%90%A6%E6%9C%89%20Set-Cookie%20%E5%AD%97%E6%AE%B5%EF%BC%88%E5%BA%94%E8%AF%A5%E6%9C%89%20refresh_token%E3%80%81access_token%E3%80%81csrf_token%EF%BC%89%E3%80%82%E5%A6%82%E6%9E%9C%E6%B2%A1%E6%9C%89%EF%BC%8C%E8%AF%B4%E6%98%8E%E5%90%8E%E7%AB%AF%E6%B2%A1%E6%9C%89%E6%AD%A3%E7%A1%AE%E4%B8%8B%E5%8F%91%20Cookie%EF%BC%8C%E9%80%9A%E5%B8%B8%E6%98%AF%20domain/path%20%E9%85%8D%E7%BD%AE%E9%97%AE%E9%A2%98%E3%80%82%0A%0A2.%20%2A%2A%E6%A3%80%E6%9F%A5%20.env%20%E5%85%B3%E9%94%AE%E9%85%8D%E7%BD%AE%2A%2A%20%20%0A%20%20%20-%20COOKIE_DOMAIN%20%E5%BF%85%E9%A1%BB%E4%B8%BA%E7%A9%BA%E6%88%96%E4%B8%8E%E4%BD%A0%E8%AE%BF%E9%97%AE%E7%9A%84%E5%9F%9F%E5%90%8D%E4%B8%80%E8%87%B4%EF%BC%88%E5%A6%82%20192.168.1.13%EF%BC%89%EF%BC%8C%E4%B8%8D%E8%A6%81%E5%B8%A6%E7%AB%AF%E5%8F%A3%E6%88%96%E5%8D%8F%E8%AE%AE%EF%BC%8C%E4%B8%8D%E8%83%BD%E6%98%AF%20localhost%E3%80%82%0A%20%20%20-%20CONSOLE_CORS_ALLOW_ORIGINS%20%E5%92%8C%20WEB_API_CORS_ALLOW_ORIGINS%20%E5%BF%85%E9%A1%BB%E7%B2%BE%E7%A1%AE%E8%AE%BE%E7%BD%AE%E4%B8%BA%20http%3A//192.168.1.13%EF%BC%88%E4%B8%8D%E8%83%BD%E6%98%AF%20%2A%EF%BC%89%EF%BC%8C%E5%90%A6%E5%88%99%E6%B5%8F%E8%A7%88%E5%99%A8%E4%B8%8D%E4%BC%9A%E5%B8%A6%20Cookie%E3%80%82%0A%20%20%20-%20RESPECT_XFORWARD_HEADERS_ENABLED%20%E5%BF%85%E9%A1%BB%E4%B8%BA%20true%E3%80%82%0A%20%20%20-%20CONSOLE_API_URL%E3%80%81CONSOLE_WEB_URL%20%E7%AD%89%E6%89%80%E6%9C%89%20URL%20%E5%BF%85%E9%A1%BB%E5%B8%A6%20/dify%20%E5%89%8D%E7%BC%80%E4%B8%94%E5%92%8C%E5%AE%9E%E9%99%85%E8%AE%BF%E9%97%AE%E4%B8%80%E8%87%B4%E3%80%82%0A%0A3.%20%2A%2A%E5%89%8D%E7%AB%AF%E6%9E%84%E5%BB%BA%2A%2A%20%20%0A%20%20%20%E4%BB%85%E8%AE%BE%E7%BD%AE%20ENV%20NEXT_PUBLIC_BASE_PATH%3D/dify%20%E4%B8%8D%E5%A4%9F%EF%BC%8C%E5%BF%85%E9%A1%BB%E5%9C%A8%20web/utils/var-basePath.js%20%E5%92%8C%20web/utils/var.ts%20%E9%87%8C%E6%89%8B%E5%8A%A8%E5%86%99%E6%AD%BB%20basePath/assetPrefix%20%E4%B8%BA%20/dify%EF%BC%8C%E7%84%B6%E5%90%8E%E9%87%8D%E6%96%B0%20build%20%E5%89%8D%E7%AB%AF%E9%95%9C%E5%83%8F%EF%BC%88docker%20build%20--no-cache%EF%BC%89%EF%BC%8C%E5%90%A6%E5%88%99%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%E5%92%8C%20API%20%E8%B7%AF%E5%BE%84%E4%BC%9A%E9%94%99%E4%B9%B1%EF%BC%8CCookie%20%E4%B9%9F%E5%8F%AF%E8%83%BD%E4%B8%A2%E5%A4%B1%E3%80%82%5B%E5%8F%82%E8%80%83%5D%28https%3A//github.com/langgenius/dify/discussions/21826%29%0A%0A4.%20%2A%2ANginx%20%E9%85%8D%E7%BD%AE%2A%2A%20%20%0A%20%20%20-%20API%20%E8%B7%AF%E7%94%B1%20strip%20%E6%8E%89%20/dify%20%E5%89%8D%E7%BC%80%EF%BC%8C%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%E4%BF%9D%E7%95%99%E3%80%82%0A%20%20%20-%20proxy_set_header%20Host%20%24host%3B%20%E5%BB%BA%E8%AE%AE%E6%94%B9%E4%B8%BA%20proxy_set_header%20Host%20%24http_host%3B%20%E5%B9%B6%E7%A1%AE%E4%BF%9D%20proxy_http_version%201.1%E3%80%82%0A%20%20%20-%20%E4%B8%8D%E8%A6%81%E6%9C%89%E9%87%8D%E5%A4%8D%E7%9A%84%20location%20%E5%9D%97%EF%BC%8C%E9%81%BF%E5%85%8D%E5%86%B2%E7%AA%81%E3%80%82%0A%20%20%20-%20%E4%B8%8D%E8%A6%81%E5%9C%A8%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%20location%20%E9%87%8C%20rewrite%20%E8%B7%AF%E5%BE%84%E3%80%82%0A%0A5.%20%2A%2A%E6%B5%8F%E8%A7%88%E5%99%A8%E7%AB%AF%E6%A3%80%E6%9F%A5%2A%2A%20%20%0A%20%20%20-%20%E7%99%BB%E5%BD%95%E5%90%8E%EF%BC%8C%E6%B5%8F%E8%A7%88%E5%99%A8%20Application/Cookies%20%E9%9D%A2%E6%9D%BF%E9%87%8C%EF%BC%8C%E5%BA%94%E8%AF%A5%E8%83%BD%E7%9C%8B%E5%88%B0%20refresh_token%E3%80%81access_token%E3%80%81csrf_token%E3%80%82%E5%A6%82%E6%9E%9C%E6%B2%A1%E6%9C%89%EF%BC%8C%E8%AF%B4%E6%98%8E%20Cookie%20%E6%B2%A1%E6%9C%89%E8%A2%AB%E6%AD%A3%E7%A1%AE%E4%B8%8B%E5%8F%91%E6%88%96%E8%A2%AB%E6%B5%8F%E8%A7%88%E5%99%A8%E6%8B%A6%E6%88%AA%E3%80%82%0A%20%20%20-%20%E6%A3%80%E6%9F%A5%E6%98%AF%E5%90%A6%E6%9C%89%20SameSite%E3%80%81Secure%E3%80%81Domain%20%E8%AD%A6%E5%91%8A%EF%BC%88%E6%AF%94%E5%A6%82%E2%80%9C%E6%AD%A4%20Cookie%20%E8%A2%AB%E9%98%BB%E6%AD%A2%E2%80%9D%EF%BC%89%E3%80%82%0A%20%20%20-%20%E6%B8%85%E7%A9%BA%E6%B5%8F%E8%A7%88%E5%99%A8%E7%BC%93%E5%AD%98%E5%92%8C%20Cookie%20%E5%90%8E%E9%87%8D%E8%AF%95%EF%BC%8C%E9%81%BF%E5%85%8D%E8%80%81%E7%9A%84%20Cookie%20%E5%B9%B2%E6%89%B0%E3%80%82%0A%0A6.%20%2A%2A%E5%90%8E%E7%AB%AF%E6%97%A5%E5%BF%97%2A%2A%20%20%0A%20%20%20-%20%E6%9F%A5%E7%9C%8B%20Dify%20%E5%90%8E%E7%AB%AF%E6%97%A5%E5%BF%97%EF%BC%8C%E7%A1%AE%E8%AE%A4%20login%20%E5%92%8C%20refresh-token%20%E8%AF%B7%E6%B1%82%E6%97%B6%E6%98%AF%E5%90%A6%E6%9C%89%20%E2%80%9CNo%20refresh%20token%20provided%E2%80%9D%20%E6%88%96%20CSRF%20%E7%9B%B8%E5%85%B3%E6%8A%A5%E9%94%99%E3%80%82%0A%0A7.%20%2A%2A%E5%B8%B8%E8%A7%81%E5%8E%9F%E5%9B%A0%E6%80%BB%E7%BB%93%2A%2A%20%20%0A%20%20%20-%20COOKIE_DOMAIN%20%E9%85%8D%E7%BD%AE%E4%B8%8D%E5%AF%B9%EF%BC%88%E4%B8%BA%E7%A9%BA%E6%88%96%E4%B8%8E%E5%AE%9E%E9%99%85%E8%AE%BF%E9%97%AE%E5%9F%9F%E5%90%8D%E4%B8%8D%E7%AC%A6%EF%BC%89%E3%80%82%0A%20%20%20-%20CORS%20%E9%85%8D%E7%BD%AE%E4%B8%8D%E5%AF%B9%EF%BC%88%E4%B8%8D%E6%98%AF%E7%B2%BE%E7%A1%AE%E5%9F%9F%E5%90%8D%EF%BC%89%E3%80%82%0A%20%20%20-%20%E5%89%8D%E7%AB%AF%E6%B2%A1%E6%9C%89%E6%AD%A3%E7%A1%AE%20build%EF%BC%8CbasePath/assetPrefix%20%E6%B2%A1%E6%9C%89%E5%86%99%E6%AD%BB%E3%80%82%0A%20%20%20-%20Nginx%20%E9%85%8D%E7%BD%AE%20strip/rewrite%20%E9%94%99%E8%AF%AF%E6%88%96%E6%9C%AA%E8%BD%AC%E5%8F%91%20Set-Cookie%E3%80%82%0A%20%20%20-%20%E6%B5%8F%E8%A7%88%E5%99%A8%E9%98%BB%E6%AD%A2%20Cookie%EF%BC%88SameSite%E3%80%81Secure%E3%80%81Domain%20%E9%97%AE%E9%A2%98%EF%BC%89%E3%80%82%0A%0A---%0A%0A%2A%2A%E8%AF%B7%E9%87%8D%E7%82%B9%E6%8F%90%E4%BE%9B%EF%BC%9A%2A%2A%0A-%20%E7%99%BB%E5%BD%95%E6%8E%A5%E5%8F%A3%EF%BC%88/dify/console/api/login%EF%BC%89%E5%93%8D%E5%BA%94%E5%A4%B4%E9%87%8C%E7%9A%84%20Set-Cookie%20%E5%86%85%E5%AE%B9%EF%BC%88%E6%88%AA%E5%9B%BE%E6%88%96%E6%96%87%E6%9C%AC%EF%BC%89%E3%80%82%0A-%20.env%20%E9%87%8C%20COOKIE_DOMAIN%E3%80%81CONSOLE_CORS_ALLOW_ORIGINS%E3%80%81WEB_API_CORS_ALLOW_ORIGINS%20%E7%9A%84%E5%AE%9E%E9%99%85%E5%80%BC%E3%80%82%0A-%20%E7%99%BB%E5%BD%95%E5%90%8E%E6%B5%8F%E8%A7%88%E5%99%A8%20Cookie%20%E9%9D%A2%E6%9D%BF%E9%87%8C%E6%98%AF%E5%90%A6%E6%9C%89%20refresh_token%E3%80%81access_token%E3%80%81csrf_token%E3%80%82%0A-%20%E5%90%8E%E7%AB%AF%E6%97%A5%E5%BF%97%E4%B8%AD%20refresh-token%20%E7%9B%B8%E5%85%B3%E6%8A%A5%E9%94%99%E3%80%82%0A%0A%E8%BF%99%E6%A0%B7%E5%8F%AF%E4%BB%A5%E7%B2%BE%E5%87%86%E5%AE%9A%E4%BD%8D%E6%98%AF%20Cookie%20%E6%B2%A1%E6%9C%89%E4%B8%8B%E5%8F%91%E3%80%81%E8%A2%AB%E6%8B%A6%E6%88%AA%EF%BC%8C%E8%BF%98%E6%98%AF%E9%85%8D%E7%BD%AE%E9%97%AE%E9%A2%98%E3%80%82%20%20%0A%E5%A6%82%E9%9C%80%E8%BF%9B%E4%B8%80%E6%AD%A5%E6%8E%92%E6%9F%A5%EF%BC%8C%E5%8F%AF%E5%8A%A0%E4%B8%B4%E6%97%B6%20header%EF%BC%88%E5%A6%82%20add_header%20X-Debug-Test%201%3B%EF%BC%89%E7%A1%AE%E8%AE%A4%20Nginx%20%E9%85%8D%E7%BD%AE%E6%98%AF%E5%90%A6%E7%94%9F%E6%95%88%E3%80%82%0A%0A%E5%8F%82%E8%80%83%EF%BC%9A%5BDify%20Cookie%20%E8%AE%BE%E7%BD%AE%E6%BA%90%E7%A0%81%5D%28https%3A//github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/api/libs/token.py%23L33-L139%29%20%20%0A%E7%9B%B8%E5%85%B3%E8%AE%A8%E8%AE%BA%EF%BC%9A%5BNginx/Cookie%20%E9%97%AE%E9%A2%98%E6%8E%92%E6%9F%A5%5D%28https%3A//github.com/langgenius/dify/issues/25793%23issuecomment-3298775664%29) [![Join Discord](https://camo.githubusercontent.com/7d2066700925db1e370d956834f9ea0e5bc92cecbe84963fbd2a363e45091b4e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6a6f696e2d3538363546323f6c6f676f3d646973636f7264266c6f676f436f6c6f723d7768697465266c6162656c3d)](https://go.dosu.dev/discord-bot) [![Share on X](https://camo.githubusercontent.com/a8bd7f3fcf3f5e3bd124eee9ae50ae2ac17b40971726665ac2121d48f9aee155/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f582d73686172652d626c61636b)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28927) **I'm sorry, I still don't quite understand the operation you mentioned. Let's take it step by step.** **My expectation is to deploy Dify and gateway Nginx using Docker on a server with an IP address of 192.168.13.1. Since the server only opens port 80 for the gateway Nginx to use, the Docker address is 172.21.240.1. I want to use this gateway Nginx proxy to run the Dify service in Docker for external access, with the access address being http://192.168.13.1/dify .** **Firstly, I did not find the web/tils/var-basePath.js file in the source code of Dify version 1.9.1. I found that it had already been removed and refactored in version 1.8.1, and new fixes were found in the next-config.js and var.ts files.** <img width="1920" height="1080" alt="Image" src="https://github.com/user-attachments/assets/dcd62be4-c911-4759-a1f3-060d89729e9b" /> <img width="1920" height="1040" alt="Image" src="https://github.com/user-attachments/assets/9c107626-84d8-4430-bdb9-4469d7699680" /> <img width="1920" height="1040" alt="Image" src="https://github.com/user-attachments/assets/e3e67e6e-2f6c-4c56-a9ad-fab675873ac3" /> **Therefore, when building the frontend image, do I only need to modify the dify/web/Dockerfile file? The modifications are as follows:** <img width="1920" height="1018" alt="Image" src="https://github.com/user-attachments/assets/3e44d2ca-8bb5-4cdb-8f8a-5cef749c4faf" /> **Am I following the correct steps?** [@dosu](https://go.dosu.dev/dosubot)

yindo commented

2026-02-21 20:08:27 -05:00

@dosubot[bot] commented on GitHub (Nov 29, 2025):

你现在的做法是正确的：在 Dify v1.9.1，前端只需要在 web/Dockerfile 里设置 ENV NEXT_PUBLIC_BASE_PATH=/dify，然后重新 build 镜像即可，无需手动修改 next.config.js 或 var.ts。这两个文件会自动读取环境变量 NEXT_PUBLIC_BASE_PATH 和 var.ts，实现 basePath/assetPrefix 的动态配置，无需硬编码。

操作步骤：

在 web/Dockerfile 里设置：
```
ENV NEXT_PUBLIC_BASE_PATH=/dify
```
其他 API 相关环境变量也可以一起设置。
执行 docker build --no-cache 重新构建前端镜像。
部署后访问 /dify 路径，检查静态资源和页面路由是否都带有 /dify 前缀。

注意事项：

不要在 next.config.js 或 var.ts 里手动写死 basePath，只需保证它们读取环境变量即可。
如果发现静态资源 404 或路由异常，优先清理浏览器缓存，确认镜像已重新 build。
Nginx 代理配置要确保 API 路径 strip 掉 /dify，静态资源保留 /dify，并正确设置 X-Forwarded-Prefix。
参考 PR：#24445、#24870 说明 basePath 已完全由环境变量控制，无需手动改代码。

如遇 Cookie 问题或 401/400 错误，重点排查后端 .env 的 COOKIE_DOMAIN、CORS 配置，以及 Nginx 是否正确转发 Set-Cookie。
有疑问随时 @dosu。

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Nov 29, 2025):  你现在的做法是正确的：在 Dify v1.9.1，前端只需要在 `web/Dockerfile` 里设置 `ENV NEXT_PUBLIC_BASE_PATH=/dify`，然后重新 build 镜像即可，无需手动修改 `next.config.js` 或 `var.ts`。这两个文件会自动读取环境变量 [`NEXT_PUBLIC_BASE_PATH`](https://github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/web/next.config.js#L95-L96) 和 [`var.ts`](https://github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/web/utils/var.ts#L123-L126)，实现 basePath/assetPrefix 的动态配置，无需硬编码。 **操作步骤：** 1. 在 `web/Dockerfile` 里设置： ``` ENV NEXT_PUBLIC_BASE_PATH=/dify ``` 其他 API 相关环境变量也可以一起设置。 2. 执行 `docker build --no-cache` 重新构建前端镜像。 3. 部署后访问 `/dify` 路径，检查静态资源和页面路由是否都带有 `/dify` 前缀。 **注意事项：** - 不要在 `next.config.js` 或 `var.ts` 里手动写死 basePath，只需保证它们读取环境变量即可。 - 如果发现静态资源 404 或路由异常，优先清理浏览器缓存，确认镜像已重新 build。 - Nginx 代理配置要确保 API 路径 strip 掉 `/dify`，静态资源保留 `/dify`，并正确设置 `X-Forwarded-Prefix`。 - 参考 PR：[#24445](https://github.com/langgenius/dify/pull/24445)、[#24870](https://github.com/langgenius/dify/pull/24870) 说明 basePath 已完全由环境变量控制，无需手动改代码。如遇 Cookie 问题或 401/400 错误，重点排查后端 `.env` 的 COOKIE_DOMAIN、CORS 配置，以及 Nginx 是否正确转发 Set-Cookie。有疑问随时 @dosu。  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- How did I do? [Good](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=other) [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github) [![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=%E4%BD%A0%E7%8E%B0%E5%9C%A8%E7%9A%84%E5%81%9A%E6%B3%95%E6%98%AF%E6%AD%A3%E7%A1%AE%E7%9A%84%EF%BC%9A%E5%9C%A8%20Dify%20v1.9.1%EF%BC%8C%E5%89%8D%E7%AB%AF%E5%8F%AA%E9%9C%80%E8%A6%81%E5%9C%A8%20%60web/Dockerfile%60%20%E9%87%8C%E8%AE%BE%E7%BD%AE%20%60ENV%20NEXT_PUBLIC_BASE_PATH%3D/dify%60%EF%BC%8C%E7%84%B6%E5%90%8E%E9%87%8D%E6%96%B0%20build%20%E9%95%9C%E5%83%8F%E5%8D%B3%E5%8F%AF%EF%BC%8C%E6%97%A0%E9%9C%80%E6%89%8B%E5%8A%A8%E4%BF%AE%E6%94%B9%20%60next.config.js%60%20%E6%88%96%20%60var.ts%60%E3%80%82%E8%BF%99%E4%B8%A4%E4%B8%AA%E6%96%87%E4%BB%B6%E4%BC%9A%E8%87%AA%E5%8A%A8%E8%AF%BB%E5%8F%96%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%20%5B%60NEXT_PUBLIC_BASE_PATH%60%5D%28https%3A//github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/web/next.config.js%23L95-L96%29%20%E5%92%8C%20%5B%60var.ts%60%5D%28https%3A//github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/web/utils/var.ts%23L123-L126%29%EF%BC%8C%E5%AE%9E%E7%8E%B0%20basePath/assetPrefix%20%E7%9A%84%E5%8A%A8%E6%80%81%E9%85%8D%E7%BD%AE%EF%BC%8C%E6%97%A0%E9%9C%80%E7%A1%AC%E7%BC%96%E7%A0%81%E3%80%82%0A%0A%2A%2A%E6%93%8D%E4%BD%9C%E6%AD%A5%E9%AA%A4%EF%BC%9A%2A%2A%0A1.%20%E5%9C%A8%20%60web/Dockerfile%60%20%E9%87%8C%E8%AE%BE%E7%BD%AE%EF%BC%9A%0A%20%20%20%60%60%60%0A%20%20%20ENV%20NEXT_PUBLIC_BASE_PATH%3D/dify%0A%20%20%20%60%60%60%0A%20%20%20%E5%85%B6%E4%BB%96%20API%20%E7%9B%B8%E5%85%B3%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E4%B9%9F%E5%8F%AF%E4%BB%A5%E4%B8%80%E8%B5%B7%E8%AE%BE%E7%BD%AE%E3%80%82%0A2.%20%E6%89%A7%E8%A1%8C%20%60docker%20build%20--no-cache%60%20%E9%87%8D%E6%96%B0%E6%9E%84%E5%BB%BA%E5%89%8D%E7%AB%AF%E9%95%9C%E5%83%8F%E3%80%82%0A3.%20%E9%83%A8%E7%BD%B2%E5%90%8E%E8%AE%BF%E9%97%AE%20%60/dify%60%20%E8%B7%AF%E5%BE%84%EF%BC%8C%E6%A3%80%E6%9F%A5%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%E5%92%8C%E9%A1%B5%E9%9D%A2%E8%B7%AF%E7%94%B1%E6%98%AF%E5%90%A6%E9%83%BD%E5%B8%A6%E6%9C%89%20%60/dify%60%20%E5%89%8D%E7%BC%80%E3%80%82%0A%0A%2A%2A%E6%B3%A8%E6%84%8F%E4%BA%8B%E9%A1%B9%EF%BC%9A%2A%2A%0A-%20%E4%B8%8D%E8%A6%81%E5%9C%A8%20%60next.config.js%60%20%E6%88%96%20%60var.ts%60%20%E9%87%8C%E6%89%8B%E5%8A%A8%E5%86%99%E6%AD%BB%20basePath%EF%BC%8C%E5%8F%AA%E9%9C%80%E4%BF%9D%E8%AF%81%E5%AE%83%E4%BB%AC%E8%AF%BB%E5%8F%96%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E5%8D%B3%E5%8F%AF%E3%80%82%0A-%20%E5%A6%82%E6%9E%9C%E5%8F%91%E7%8E%B0%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%20404%20%E6%88%96%E8%B7%AF%E7%94%B1%E5%BC%82%E5%B8%B8%EF%BC%8C%E4%BC%98%E5%85%88%E6%B8%85%E7%90%86%E6%B5%8F%E8%A7%88%E5%99%A8%E7%BC%93%E5%AD%98%EF%BC%8C%E7%A1%AE%E8%AE%A4%E9%95%9C%E5%83%8F%E5%B7%B2%E9%87%8D%E6%96%B0%20build%E3%80%82%0A-%20Nginx%20%E4%BB%A3%E7%90%86%E9%85%8D%E7%BD%AE%E8%A6%81%E7%A1%AE%E4%BF%9D%20API%20%E8%B7%AF%E5%BE%84%20strip%20%E6%8E%89%20%60/dify%60%EF%BC%8C%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%E4%BF%9D%E7%95%99%20%60/dify%60%EF%BC%8C%E5%B9%B6%E6%AD%A3%E7%A1%AE%E8%AE%BE%E7%BD%AE%20%60X-Forwarded-Prefix%60%E3%80%82%0A-%20%E5%8F%82%E8%80%83%20PR%EF%BC%9A%5B%2324445%5D%28https%3A//github.com/langgenius/dify/pull/24445%29%E3%80%81%5B%2324870%5D%28https%3A//github.com/langgenius/dify/pull/24870%29%20%E8%AF%B4%E6%98%8E%20basePath%20%E5%B7%B2%E5%AE%8C%E5%85%A8%E7%94%B1%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%8E%A7%E5%88%B6%EF%BC%8C%E6%97%A0%E9%9C%80%E6%89%8B%E5%8A%A8%E6%94%B9%E4%BB%A3%E7%A0%81%E3%80%82%0A%0A%E5%A6%82%E9%81%87%20Cookie%20%E9%97%AE%E9%A2%98%E6%88%96%20401/400%20%E9%94%99%E8%AF%AF%EF%BC%8C%E9%87%8D%E7%82%B9%E6%8E%92%E6%9F%A5%E5%90%8E%E7%AB%AF%20%60.env%60%20%E7%9A%84%20COOKIE_DOMAIN%E3%80%81CORS%20%E9%85%8D%E7%BD%AE%EF%BC%8C%E4%BB%A5%E5%8F%8A%20Nginx%20%E6%98%AF%E5%90%A6%E6%AD%A3%E7%A1%AE%E8%BD%AC%E5%8F%91%20Set-Cookie%E3%80%82%20%20%0A%E6%9C%89%E7%96%91%E9%97%AE%E9%9A%8F%E6%97%B6%20%40dosu%E3%80%82) [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28927)

yindo commented

2026-02-21 20:08:27 -05:00

@bumblebee-code-gh commented on GitHub (Nov 29, 2025):

你现在的做法是正确的：在 Dify v1.9.1，前端只需要在 web/Dockerfile 里设置 ENV NEXT_PUBLIC_BASE_PATH=/dify，然后重新 build 镜像即可，无需手动修改 next.config.js 或 var.ts。这两个文件会自动读取环境变量 NEXT_PUBLIC_BASE_PATH 和 var.ts，实现 basePath/assetPrefix 的动态配置，无需硬编码。

操作步骤：
在 web/Dockerfile 里设置：
ENV NEXT_PUBLIC_BASE_PATH=/dify
其他 API 相关环境变量也可以一起设置。
执行 docker build --no-cache 重新构建前端镜像。

部署后访问 /dify 路径，检查静态资源和页面路由是否都带有 /dify 前缀。
注意事项：

不要在 next.config.js 或 var.ts 里手动写死 basePath，只需保证它们读取环境变量即可。

如果发现静态资源 404 或路由异常，优先清理浏览器缓存，确认镜像已重新 build。

Nginx 代理配置要确保 API 路径 strip 掉 /dify，静态资源保留 /dify，并正确设置 X-Forwarded-Prefix。

参考 PR：#24445、#24870 说明 basePath 已完全由环境变量控制，无需手动改代码。

如遇 Cookie 问题或 401/400 错误，重点排查后端 .env 的 COOKIE_DOMAIN、CORS 配置，以及 Nginx 是否正确转发 Set-Cookie。有疑问随时 @dosu。

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

May I ask if in dify/web/dockerfile, besides modifying ENV NEXT_PUBLIC_BASE_PATH=/dify, ENV CONSOLE_API_URL= http://127.0.0.1:5001 And ENV APP_SPI-URL= http://127.0.0.1:5001 Need to be set to http://192.168.13.1:80/dify Should we keep it the same and then run Docker build -- no cache to rebuild the frontend image?

@dosu

@bumblebee-code-gh commented on GitHub (Nov 29, 2025): > 你现在的做法是正确的：在 Dify v1.9.1，前端只需要在 `web/Dockerfile` 里设置 `ENV NEXT_PUBLIC_BASE_PATH=/dify`，然后重新 build 镜像即可，无需手动修改 `next.config.js` 或 `var.ts`。这两个文件会自动读取环境变量 [`NEXT_PUBLIC_BASE_PATH`](https://github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/web/next.config.js#L95-L96) 和 [`var.ts`](https://github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/web/utils/var.ts#L123-L126)，实现 basePath/assetPrefix 的动态配置，无需硬编码。 > > **操作步骤：** > > 1. 在 `web/Dockerfile` 里设置： > ``` > ENV NEXT_PUBLIC_BASE_PATH=/dify > ``` > > > > > 其他 API 相关环境变量也可以一起设置。 > 2. 执行 `docker build --no-cache` 重新构建前端镜像。 > 3. 部署后访问 `/dify` 路径，检查静态资源和页面路由是否都带有 `/dify` 前缀。 > > **注意事项：** > > * 不要在 `next.config.js` 或 `var.ts` 里手动写死 basePath，只需保证它们读取环境变量即可。 > * 如果发现静态资源 404 或路由异常，优先清理浏览器缓存，确认镜像已重新 build。 > * Nginx 代理配置要确保 API 路径 strip 掉 `/dify`，静态资源保留 `/dify`，并正确设置 `X-Forwarded-Prefix`。 > * 参考 PR：[#24445](https://github.com/langgenius/dify/pull/24445)、[#24870](https://github.com/langgenius/dify/pull/24870) 说明 basePath 已完全由环境变量控制，无需手动改代码。 > > 如遇 Cookie 问题或 401/400 错误，重点排查后端 `.env` 的 COOKIE_DOMAIN、CORS 配置，以及 Nginx 是否正确转发 Set-Cookie。有疑问随时 [@dosu](https://github.com/dosu)。 > > _To reply, just mention [@dosu](https://go.dosu.dev/dosubot)._ > > How did I do? [Good](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/fd048ae9-176b-4f42-91da-76a74c3b65f7?feedback_type=other) > > [![Chat with Dosu](https://camo.githubusercontent.com/7c571478962a6b8a5d47cac74b6824c75e4f6731bba52377e6007f9150462923/68747470733a2f2f646f73752e6465762f646f73752d636861742d62616467652e737667)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github) [![Open in Cursor](https://camo.githubusercontent.com/bdf7dbded65ee585887f47e5fd6fa099ea0933088b4b03d02e83b4def50154d4/68747470733a2f2f646f73752e6465762f646f73752d696e2d637572736f722e737667)](https://cursor.com/link/prompt?text=%E4%BD%A0%E7%8E%B0%E5%9C%A8%E7%9A%84%E5%81%9A%E6%B3%95%E6%98%AF%E6%AD%A3%E7%A1%AE%E7%9A%84%EF%BC%9A%E5%9C%A8%20Dify%20v1.9.1%EF%BC%8C%E5%89%8D%E7%AB%AF%E5%8F%AA%E9%9C%80%E8%A6%81%E5%9C%A8%20%60web/Dockerfile%60%20%E9%87%8C%E8%AE%BE%E7%BD%AE%20%60ENV%20NEXT_PUBLIC_BASE_PATH%3D/dify%60%EF%BC%8C%E7%84%B6%E5%90%8E%E9%87%8D%E6%96%B0%20build%20%E9%95%9C%E5%83%8F%E5%8D%B3%E5%8F%AF%EF%BC%8C%E6%97%A0%E9%9C%80%E6%89%8B%E5%8A%A8%E4%BF%AE%E6%94%B9%20%60next.config.js%60%20%E6%88%96%20%60var.ts%60%E3%80%82%E8%BF%99%E4%B8%A4%E4%B8%AA%E6%96%87%E4%BB%B6%E4%BC%9A%E8%87%AA%E5%8A%A8%E8%AF%BB%E5%8F%96%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%20%5B%60NEXT_PUBLIC_BASE_PATH%60%5D%28https%3A//github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/web/next.config.js%23L95-L96%29%20%E5%92%8C%20%5B%60var.ts%60%5D%28https%3A//github.com/langgenius/dify/blob/ddad2460f3ee4906df6819c48babaeab62221b43/web/utils/var.ts%23L123-L126%29%EF%BC%8C%E5%AE%9E%E7%8E%B0%20basePath/assetPrefix%20%E7%9A%84%E5%8A%A8%E6%80%81%E9%85%8D%E7%BD%AE%EF%BC%8C%E6%97%A0%E9%9C%80%E7%A1%AC%E7%BC%96%E7%A0%81%E3%80%82%0A%0A%2A%2A%E6%93%8D%E4%BD%9C%E6%AD%A5%E9%AA%A4%EF%BC%9A%2A%2A%0A1.%20%E5%9C%A8%20%60web/Dockerfile%60%20%E9%87%8C%E8%AE%BE%E7%BD%AE%EF%BC%9A%0A%20%20%20%60%60%60%0A%20%20%20ENV%20NEXT_PUBLIC_BASE_PATH%3D/dify%0A%20%20%20%60%60%60%0A%20%20%20%E5%85%B6%E4%BB%96%20API%20%E7%9B%B8%E5%85%B3%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E4%B9%9F%E5%8F%AF%E4%BB%A5%E4%B8%80%E8%B5%B7%E8%AE%BE%E7%BD%AE%E3%80%82%0A2.%20%E6%89%A7%E8%A1%8C%20%60docker%20build%20--no-cache%60%20%E9%87%8D%E6%96%B0%E6%9E%84%E5%BB%BA%E5%89%8D%E7%AB%AF%E9%95%9C%E5%83%8F%E3%80%82%0A3.%20%E9%83%A8%E7%BD%B2%E5%90%8E%E8%AE%BF%E9%97%AE%20%60/dify%60%20%E8%B7%AF%E5%BE%84%EF%BC%8C%E6%A3%80%E6%9F%A5%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%E5%92%8C%E9%A1%B5%E9%9D%A2%E8%B7%AF%E7%94%B1%E6%98%AF%E5%90%A6%E9%83%BD%E5%B8%A6%E6%9C%89%20%60/dify%60%20%E5%89%8D%E7%BC%80%E3%80%82%0A%0A%2A%2A%E6%B3%A8%E6%84%8F%E4%BA%8B%E9%A1%B9%EF%BC%9A%2A%2A%0A-%20%E4%B8%8D%E8%A6%81%E5%9C%A8%20%60next.config.js%60%20%E6%88%96%20%60var.ts%60%20%E9%87%8C%E6%89%8B%E5%8A%A8%E5%86%99%E6%AD%BB%20basePath%EF%BC%8C%E5%8F%AA%E9%9C%80%E4%BF%9D%E8%AF%81%E5%AE%83%E4%BB%AC%E8%AF%BB%E5%8F%96%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E5%8D%B3%E5%8F%AF%E3%80%82%0A-%20%E5%A6%82%E6%9E%9C%E5%8F%91%E7%8E%B0%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%20404%20%E6%88%96%E8%B7%AF%E7%94%B1%E5%BC%82%E5%B8%B8%EF%BC%8C%E4%BC%98%E5%85%88%E6%B8%85%E7%90%86%E6%B5%8F%E8%A7%88%E5%99%A8%E7%BC%93%E5%AD%98%EF%BC%8C%E7%A1%AE%E8%AE%A4%E9%95%9C%E5%83%8F%E5%B7%B2%E9%87%8D%E6%96%B0%20build%E3%80%82%0A-%20Nginx%20%E4%BB%A3%E7%90%86%E9%85%8D%E7%BD%AE%E8%A6%81%E7%A1%AE%E4%BF%9D%20API%20%E8%B7%AF%E5%BE%84%20strip%20%E6%8E%89%20%60/dify%60%EF%BC%8C%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%E4%BF%9D%E7%95%99%20%60/dify%60%EF%BC%8C%E5%B9%B6%E6%AD%A3%E7%A1%AE%E8%AE%BE%E7%BD%AE%20%60X-Forwarded-Prefix%60%E3%80%82%0A-%20%E5%8F%82%E8%80%83%20PR%EF%BC%9A%5B%2324445%5D%28https%3A//github.com/langgenius/dify/pull/24445%29%E3%80%81%5B%2324870%5D%28https%3A//github.com/langgenius/dify/pull/24870%29%20%E8%AF%B4%E6%98%8E%20basePath%20%E5%B7%B2%E5%AE%8C%E5%85%A8%E7%94%B1%E7%8E%AF%E5%A2%83%E5%8F%98%E9%87%8F%E6%8E%A7%E5%88%B6%EF%BC%8C%E6%97%A0%E9%9C%80%E6%89%8B%E5%8A%A8%E6%94%B9%E4%BB%A3%E7%A0%81%E3%80%82%0A%0A%E5%A6%82%E9%81%87%20Cookie%20%E9%97%AE%E9%A2%98%E6%88%96%20401/400%20%E9%94%99%E8%AF%AF%EF%BC%8C%E9%87%8D%E7%82%B9%E6%8E%92%E6%9F%A5%E5%90%8E%E7%AB%AF%20%60.env%60%20%E7%9A%84%20COOKIE_DOMAIN%E3%80%81CORS%20%E9%85%8D%E7%BD%AE%EF%BC%8C%E4%BB%A5%E5%8F%8A%20Nginx%20%E6%98%AF%E5%90%A6%E6%AD%A3%E7%A1%AE%E8%BD%AC%E5%8F%91%20Set-Cookie%E3%80%82%20%20%0A%E6%9C%89%E7%96%91%E9%97%AE%E9%9A%8F%E6%97%B6%20%40dosu%E3%80%82) [![Join Discord](https://camo.githubusercontent.com/7d2066700925db1e370d956834f9ea0e5bc92cecbe84963fbd2a363e45091b4e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6a6f696e2d3538363546323f6c6f676f3d646973636f7264266c6f676f436f6c6f723d7768697465266c6162656c3d)](https://go.dosu.dev/discord-bot) [![Share on X](https://camo.githubusercontent.com/a8bd7f3fcf3f5e3bd124eee9ae50ae2ac17b40971726665ac2121d48f9aee155/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f582d73686172652d626c61636b)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28927) **May I ask if in dify/web/dockerfile, besides modifying ENV NEXT_PUBLIC_BASE_PATH=/dify, ENV CONSOLE_API_URL= http://127.0.0.1:5001 And ENV APP_SPI-URL= http://127.0.0.1:5001 Need to be set to http://192.168.13.1:80/dify Should we keep it the same and then run Docker build -- no cache to rebuild the frontend image?** <img width="1920" height="950" alt="Image" src="https://github.com/user-attachments/assets/1bc3d40f-14b6-4251-be4f-abb97dce53e5" /> [@dosu](https://go.dosu.dev/dosubot)

yindo commented

2026-02-21 20:08:27 -05:00

@dosubot[bot] commented on GitHub (Nov 29, 2025):

是的，在 Dify v1.9.1 前端部署到子路径（如 /dify）时，web/Dockerfile 里的 ENV CONSOLE_API_URL 和 ENV APP_API_URL 必须都设置为完整的外部访问地址（带 /dify 前缀），比如：

ENV CONSOLE_API_URL=http://192.168.13.1:80/dify
ENV APP_API_URL=http://192.168.13.1:80/dify

不能保留默认的 http://127.0.0.1:5001，否则前端生成的 API 请求和鉴权回调会出错，导致 401/400 等问题。设置完成后，务必执行 docker build --no-cache 重新构建前端镜像，这样这些变量才会被写入静态构建产物并在运行时生效。

这些变量会被 entrypoint.sh 导出为 NEXT_PUBLIC_API_PREFIX、NEXT_PUBLIC_PUBLIC_API_PREFIX 等，前端所有 API 路径和鉴权跳转都依赖于它们，必须与实际外部访问路径一致（即带 /dify 前缀）参考更多说明。

最佳实践：

后端 .env 里的 CONSOLE_API_URL、APP_API_URL 也要保持一致。
Nginx 代理 strip 掉 /dify 前缀转发 API，静态资源保留 /dify。
设置 X-Forwarded-Prefix: /dify，CORS/Cookie 域名配置要精确。
每次修改这些变量都要重新 build 前端镜像，否则不会生效。

如还有 401/400 问题，重点排查 Cookie、CORS、Nginx 配置和浏览器缓存。如需进一步协助，随时 @dosu。

To reply, just mention @dosu.

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

@dosubot[bot] commented on GitHub (Nov 29, 2025):  是的，**在 Dify v1.9.1 前端部署到子路径（如 /dify）时，web/Dockerfile 里的 ENV CONSOLE_API_URL 和 ENV APP_API_URL 必须都设置为完整的外部访问地址（带 /dify 前缀），比如：** ``` ENV CONSOLE_API_URL=http://192.168.13.1:80/dify ENV APP_API_URL=http://192.168.13.1:80/dify ``` 不能保留默认的 http://127.0.0.1:5001，否则前端生成的 API 请求和鉴权回调会出错，导致 401/400 等问题。**设置完成后，务必执行 `docker build --no-cache` 重新构建前端镜像**，这样这些变量才会被写入静态构建产物并在运行时生效。这些变量会被 entrypoint.sh 导出为 NEXT_PUBLIC_API_PREFIX、NEXT_PUBLIC_PUBLIC_API_PREFIX 等，前端所有 API 路径和鉴权跳转都依赖于它们，必须与实际外部访问路径一致（即带 /dify 前缀）[参考](https://github.com/langgenius/dify/pull/24445) [更多说明](https://github.com/langgenius/dify/discussions/28296#discussioncomment-14995680)。 **最佳实践：** - 后端 .env 里的 CONSOLE_API_URL、APP_API_URL 也要保持一致。 - Nginx 代理 strip 掉 /dify 前缀转发 API，静态资源保留 /dify。 - 设置 X-Forwarded-Prefix: /dify，CORS/Cookie 域名配置要精确。 - 每次修改这些变量都要重新 build 前端镜像，否则不会生效。如还有 401/400 问题，重点排查 Cookie、CORS、Nginx 配置和浏览器缓存。如需进一步协助，随时 @dosu。  *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- How did I do? [Good](https://app.dosu.dev/response-feedback/5ed33928-2087-4f4b-88cd-e139ddeacb45?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/5ed33928-2087-4f4b-88cd-e139ddeacb45?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/5ed33928-2087-4f4b-88cd-e139ddeacb45?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/5ed33928-2087-4f4b-88cd-e139ddeacb45?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/5ed33928-2087-4f4b-88cd-e139ddeacb45?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/5ed33928-2087-4f4b-88cd-e139ddeacb45?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/5ed33928-2087-4f4b-88cd-e139ddeacb45?feedback_type=other) [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github) [![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=%E6%98%AF%E7%9A%84%EF%BC%8C%2A%2A%E5%9C%A8%20Dify%20v1.9.1%20%E5%89%8D%E7%AB%AF%E9%83%A8%E7%BD%B2%E5%88%B0%E5%AD%90%E8%B7%AF%E5%BE%84%EF%BC%88%E5%A6%82%20/dify%EF%BC%89%E6%97%B6%EF%BC%8Cweb/Dockerfile%20%E9%87%8C%E7%9A%84%20ENV%20CONSOLE_API_URL%20%E5%92%8C%20ENV%20APP_API_URL%20%E5%BF%85%E9%A1%BB%E9%83%BD%E8%AE%BE%E7%BD%AE%E4%B8%BA%E5%AE%8C%E6%95%B4%E7%9A%84%E5%A4%96%E9%83%A8%E8%AE%BF%E9%97%AE%E5%9C%B0%E5%9D%80%EF%BC%88%E5%B8%A6%20/dify%20%E5%89%8D%E7%BC%80%EF%BC%89%EF%BC%8C%E6%AF%94%E5%A6%82%EF%BC%9A%2A%2A%0A%0A%60%60%60%0AENV%20CONSOLE_API_URL%3Dhttp%3A//192.168.13.1%3A80/dify%0AENV%20APP_API_URL%3Dhttp%3A//192.168.13.1%3A80/dify%0A%60%60%60%0A%0A%E4%B8%8D%E8%83%BD%E4%BF%9D%E7%95%99%E9%BB%98%E8%AE%A4%E7%9A%84%20http%3A//127.0.0.1%3A5001%EF%BC%8C%E5%90%A6%E5%88%99%E5%89%8D%E7%AB%AF%E7%94%9F%E6%88%90%E7%9A%84%20API%20%E8%AF%B7%E6%B1%82%E5%92%8C%E9%89%B4%E6%9D%83%E5%9B%9E%E8%B0%83%E4%BC%9A%E5%87%BA%E9%94%99%EF%BC%8C%E5%AF%BC%E8%87%B4%20401/400%20%E7%AD%89%E9%97%AE%E9%A2%98%E3%80%82%2A%2A%E8%AE%BE%E7%BD%AE%E5%AE%8C%E6%88%90%E5%90%8E%EF%BC%8C%E5%8A%A1%E5%BF%85%E6%89%A7%E8%A1%8C%20%60docker%20build%20--no-cache%60%20%E9%87%8D%E6%96%B0%E6%9E%84%E5%BB%BA%E5%89%8D%E7%AB%AF%E9%95%9C%E5%83%8F%2A%2A%EF%BC%8C%E8%BF%99%E6%A0%B7%E8%BF%99%E4%BA%9B%E5%8F%98%E9%87%8F%E6%89%8D%E4%BC%9A%E8%A2%AB%E5%86%99%E5%85%A5%E9%9D%99%E6%80%81%E6%9E%84%E5%BB%BA%E4%BA%A7%E7%89%A9%E5%B9%B6%E5%9C%A8%E8%BF%90%E8%A1%8C%E6%97%B6%E7%94%9F%E6%95%88%E3%80%82%0A%0A%E8%BF%99%E4%BA%9B%E5%8F%98%E9%87%8F%E4%BC%9A%E8%A2%AB%20entrypoint.sh%20%E5%AF%BC%E5%87%BA%E4%B8%BA%20NEXT_PUBLIC_API_PREFIX%E3%80%81NEXT_PUBLIC_PUBLIC_API_PREFIX%20%E7%AD%89%EF%BC%8C%E5%89%8D%E7%AB%AF%E6%89%80%E6%9C%89%20API%20%E8%B7%AF%E5%BE%84%E5%92%8C%E9%89%B4%E6%9D%83%E8%B7%B3%E8%BD%AC%E9%83%BD%E4%BE%9D%E8%B5%96%E4%BA%8E%E5%AE%83%E4%BB%AC%EF%BC%8C%E5%BF%85%E9%A1%BB%E4%B8%8E%E5%AE%9E%E9%99%85%E5%A4%96%E9%83%A8%E8%AE%BF%E9%97%AE%E8%B7%AF%E5%BE%84%E4%B8%80%E8%87%B4%EF%BC%88%E5%8D%B3%E5%B8%A6%20/dify%20%E5%89%8D%E7%BC%80%EF%BC%89%5B%E5%8F%82%E8%80%83%5D%28https%3A//github.com/langgenius/dify/pull/24445%29%20%5B%E6%9B%B4%E5%A4%9A%E8%AF%B4%E6%98%8E%5D%28https%3A//github.com/langgenius/dify/discussions/28296%23discussioncomment-14995680%29%E3%80%82%0A%0A%2A%2A%E6%9C%80%E4%BD%B3%E5%AE%9E%E8%B7%B5%EF%BC%9A%2A%2A%0A-%20%E5%90%8E%E7%AB%AF%20.env%20%E9%87%8C%E7%9A%84%20CONSOLE_API_URL%E3%80%81APP_API_URL%20%E4%B9%9F%E8%A6%81%E4%BF%9D%E6%8C%81%E4%B8%80%E8%87%B4%E3%80%82%0A-%20Nginx%20%E4%BB%A3%E7%90%86%20strip%20%E6%8E%89%20/dify%20%E5%89%8D%E7%BC%80%E8%BD%AC%E5%8F%91%20API%EF%BC%8C%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%E4%BF%9D%E7%95%99%20/dify%E3%80%82%0A-%20%E8%AE%BE%E7%BD%AE%20X-Forwarded-Prefix%3A%20/dify%EF%BC%8CCORS/Cookie%20%E5%9F%9F%E5%90%8D%E9%85%8D%E7%BD%AE%E8%A6%81%E7%B2%BE%E7%A1%AE%E3%80%82%0A-%20%E6%AF%8F%E6%AC%A1%E4%BF%AE%E6%94%B9%E8%BF%99%E4%BA%9B%E5%8F%98%E9%87%8F%E9%83%BD%E8%A6%81%E9%87%8D%E6%96%B0%20build%20%E5%89%8D%E7%AB%AF%E9%95%9C%E5%83%8F%EF%BC%8C%E5%90%A6%E5%88%99%E4%B8%8D%E4%BC%9A%E7%94%9F%E6%95%88%E3%80%82%0A%0A%E5%A6%82%E8%BF%98%E6%9C%89%20401/400%20%E9%97%AE%E9%A2%98%EF%BC%8C%E9%87%8D%E7%82%B9%E6%8E%92%E6%9F%A5%20Cookie%E3%80%81CORS%E3%80%81Nginx%20%E9%85%8D%E7%BD%AE%E5%92%8C%E6%B5%8F%E8%A7%88%E5%99%A8%E7%BC%93%E5%AD%98%E3%80%82%E5%A6%82%E9%9C%80%E8%BF%9B%E4%B8%80%E6%AD%A5%E5%8D%8F%E5%8A%A9%EF%BC%8C%E9%9A%8F%E6%97%B6%20%40dosu%E3%80%82) [![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot) [![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/28927)

yindo commented

2026-02-21 20:08:27 -05:00

@crazywoola commented on GitHub (Nov 29, 2025):

This is only for bug report, if you would like to ask a question, please head to Discussions.

@crazywoola commented on GitHub (Nov 29, 2025): This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general).

yindo commented

2026-02-21 20:08:27 -05:00

@bumblebee-code-gh commented on GitHub (Nov 29, 2025):

This is only for bug report, if you would like to ask a question, please head to Discussions.

Hello, may I ask if you can help me solve this problem? I spent a lot of time following the instructions but it didn't work

@bumblebee-code-gh commented on GitHub (Nov 29, 2025): > This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). Hello, may I ask if you can help me solve this problem? I spent a lot of time following the instructions but it didn't work

yindo referenced this issue

2026-02-21 20:45:37 -05:00

[PR #20681] Fix: style of radio checked #29464

Sign in to join this conversation.

Branches Tags

main

build/cus-1418-annotation-probe

deploy/agent

feat/hitl-im-dev

fix/dify-2825-agent-chat-scope

chore/support-preview-mode-fe

deploy/dev

0722-happy-path-complete

deploy/saas

0721-happy-path-smoke

0721-document-detail

0720-documents-tasks

0720-crawl-selection

0720-crawl-preview

0720-source-connections

0720-create-knowledge

0720-new-rag-contracts

0720-new-rag-list

lts/1.13.x

perf/optimize-markdown-renderer

deploy/enterprise

gareth/esq1-170-rbac-for-agent

yanli/refactor-sandbox-and-e2b

copilot/fix-security-issue

feat/ce-telemetry-dev

release/e-1.11.4

hotfix/cus-1422-enterprise-api-timeout

feat/fix-undefined-answer-preview

hotfix/1.15.0-fix.15

laipz8200/human-input-loop-iteration

codex/migrate-knowledge-fs

hotfix/1.15.0-fix.14

deploy/workflow-archive-catalog-discovery

dependabot/uv/api/pydantic-09001a97e5

laipz8200/completion-workflow-entry

dependabot/uv/api/lts/1.13.x/python-packages-6c2bf7110c

dependabot/uv/api/storage-4219cfbece

dependabot/uv/api/lts/1.13.x/dev-6fc4f8b90c

dependabot/uv/api/llm-46e0cee538

dependabot/uv/api/lts/1.13.x/vdb-72526f7860

dependabot/uv/api/opentelemetry-b8005594e1

dependabot/uv/api/lts/1.13.x/storage-4310e8b8d8

dependabot/uv/api/lts/1.13.x/database-c0fba9b420

dependabot/uv/api/lts/1.13.x/llm-5ce1d68736

dependabot/uv/api/lts/1.13.x/pydantic-09001a97e5

dependabot/uv/api/lts/1.13.x/opentelemetry-b8005594e1

dependabot/uv/api/google-68de7a6be5

dependabot/github_actions/lts/1.13.x/github-actions-dependencies-1a36b91cf1

dependabot/uv/api/lts/1.13.x/google-c93828e58f

dependabot/uv/api/lts/1.13.x/flask-1086fc46af

0717-knowledge-fs-contract

feat/secret-scrub-persistence

feat/llm-ft-timeout

feat/appdeploy-selected-workflow-dsl

0715-new-rag

laipz8200/llm-environment-variables

release/ee-1.15.0-hotfix

laipz8200/chore-remove-feature-preview-root-env

dependabot/go_modules/dify-agent-runtime/golang.org/x/net-0.55.0

hotfix/1.15.0-fix.12

hotfix/1.15.0-fix.12-cherrypick

hotfix/1.15.0-fix.13

build/invite-seats-precheck

hotfix/1.15.0-fix.11

laipz8200/workflow-persistence-mixed-mode

hotfix/1.15.0-fix.10

zhangxin/eng-558-licensed-seats-1.15

fix/wta-1307-effect-suspense-read

feat/cli-skills-agents

0713-vp-lint

fix/agent-roster-answer-completion-main

feat/pay-by-invoice

codex/run-external-e2e-main-ci

agent/remove-sandbox-bind-mounts

feat/agent-v2-e2e-test

hotfix/1.15.0-fix.9

hotfix/1.15.0-fix.8

build/test-archive-export

linw/restore-agent-message-delta-feat

hotfix/1.15.0-fix.7

hotfix/1.15.0-fix.6

codex/pr-38227-session-types

codex/pr-38227-session-scope-split

fix/ui-fix

hotfix/1.15.0-fix.4

codex/review-pr-38480

hotfix/1.15.0-fix.2

copilot/fix-web-full-stack-e2e-job

fix/dify-2738-agent-node-dsl-export

hotfix/1.15.0-fix.3

fix/scope-segment-batch-delete

laipz8200/scope-segment-route-lookup

chore/i18n-sync-7b7956f3e7ca-e901a65a

codex/upgrade-orpc-v2-beta

hotfix/1.15.0-fix.1

codex/upgrade-openapi-ts-autofix

codex/upgrade-next-16-3-preview

hotfix/1.15.0-fix.0

hotfix/web-detail-adjustment-before-release

release/e-1.15.0

codex/replace-lamejs-with-mediabunny

copilot/add-more-tests

deploy/archive-db-resilience

fix/studio-nav-home-button

hotfix/1.14.2-fix.13

worktree-token-expired-error-code

hotfix-1.14.2-fix.12

codex/agent-v2-state-graph

codex/refactor-deployment-detail-components

hotfix/1.14.2-fix.12

build/fix/workflow-error-hanging

work/dify-2585-agent-drafts-pr

fix/dify-2574-soul-files-kv

fix/dify-2554-debug-conversation-per-user

hotfix/1.14.2-fix.11

feat/openapi-rbac

test/cli-e2e-error-body-contract

build/optimize-clean-messages-eligible-apps

zhaohao1004/optimize-clean-messages-cursor

gh-readonly-queue/main/pr-37592-c71f03f5902031b7c02e61af3aff5c2dee6f7d85

build/optimize-clean-messages-cursor

feat/country

codex/vp-fmt-migration

hotfix/1.14.2-fix.10

hotfix/1.14.2-fix.9

hotfix/1.14.2-fix.8

hotfix/1.14.2-fix.7

hotfix/1.14.2-fix.6

codex/page-title-updates

feat/agent-mention-stable-ids

fix/guard-workspace-with-defualt-roles

build/pr-37227-free-plan-workflow-run-cleanup

feat/cli-e2e-test-suite

feat/ui-start-node

feat/hitl-file-in-body

copilot/dify-team-question-agent-node

fix/wta-438-device-sso-redirect-origin

hotfix/1.14.2-fix.5

feat/dev-snippet-fronted

feat/mcp-token-transfer

chore/keep-info-icon-the-same-postion

codex/local-app-list-tag-filter

feat/snippet-new

hotfix/1.14.2-fix.4

codex/migrate-var-reference-combobox

hotfix/1.14.2-fix.3

feat/marketplace-template

chore/deploy-saas-workflow

hotfix/1.14.2-fix.2

build/cli

codex/snp-406-pointer-position-ref

hotfix/1.14.1-fix.3

build/feat/model-type-migration-script

fix/webapp-disabled-not-jump-to-webapp-login

fix/lb-model-type-dedup

song/eng-379-file-output-check-executor

chore/bump-authlib-1.6.12

fix/tag-trigger-preserve-case

chore/bump-sendgrid-lts-1.13.x

fix/model-type-enum-construction

refactor/add-missing-override-decorator

work/web-mcp-1.14.1

copilot/check-runtime-limits

laipz8200/workflow-response-stream-filter

copilot/query-issues-pr-images

laipz8200/fix-autofix-contract-generation

copilot/fix-autofix-job-failure

codex/deprecate-sys-files-compat

codex/fix-scrolling-issue-with-overflow-visible

copilot/research-retrieval-attachment-consumption

copilot/research-agent-node-implementation

chore/upgrade-xyflow-v12

hotfix/1.14.1-fix.1

build/1.14.1-fix.1-langfuse

hotfix/1.14.1-fix.2

feat/lts-lazy-dialogue-count

fix/can-not-create-knowledge

codex/fix-marketplace-hero-shake

codex/tag-name-url-filter

upgrade-graphon-to-0-3-0

codex/app-delete-enter-confirm

build/sample-tidb

codex/revert-pr-35708

chore/remove-dify-deploy-script

chore/simpler-deploy

lts/1.13.x-fix-35910

feat/storage-path-prefix

hotfix/1.13.3-fix10

hotfix/1.13.3-fix9

hotfix/1.14.0-fix.4

hotfix/1.14.0-fix.3

hotfix/1.14.0-fix.2

revert-35748-4-30-open-api

feat/upgrade-graphon

copilot/research-celery-task-ttl

hotfix/1.14.0-fix.1

copilot/fix-css-issue

feat/s3-public-base-url

hotfix/1.13.3-fix8

build/depot-speed-benchmark-20260426

build/depot-speed-benchmark-20260426-warm

hotfix/1.13.3-fix7

feat/evaluation

fix/workflow-line

chore/dependency-upgrade

deploy/zhaohao

feat/replayable-stream

feat/show-the-hierarchy-in-phonenix-trace

p363-reviewed

build/billing-v3

copilot/list-contributions-to-dify

cursor/migrate-tooltip-to-popover-infotips

refactor/quota-service

feat/new-biliing-quota

hotfix/1.13.3-fix6

cursor/dify-ui-infra

p363-hjlarry

cursor/refactor-select-trigger-api

chore/lts-13x-bump-deps

codex/tighten-button-tone-types

locate-queue-autocreate-deps

hotfix/1.13.3-fix5

feat/new-agent-node

hotfix/1.13.3-fix4

feat/per-db-credential

chore/i18n-sync-208604a3a819-9220dd74

chore/i18n-sync-1b369cede4b4-0e13ce3f

chore/i18n-sync-c93e40212e4c-0e13ce3f

codex/fix-vite-audit-in-sdk-test

copilot/fix-agent-dialogue-input-limit

codex/dify-ui-package-migration

4-2-no-global-loading

fix/ps-not-send

3-18-no-global-loading

feat/support-agent-sandbox

hotfix/1.13.3-fix3

hotfix/1.13.3-fix2

4-1-unocss

build/feat/saas-quota-v4

feat/remove-unused-is-deleted-from-conversation

codex-add-podman-compose-dev-scripts

fix-partnerstack-cookie-sync

hotfix/1.13.3-fix1

3-31-vite-task-cache

test/add-test-case-for-prompt-editor

build/feat/saas-quota

build/feat/saas-quota-v2

deploy/agent-dev

yanli/fix-iter-log

review-myscale-sqli

codex/force-node24-for-actions

ci/docker-build-narrowing

chore/dependabot-alert-to-bot

verify-email-reset-flow

3-26-cache-lint-for-autofix

gh-readonly-queue/main/pr-34120-2cbcf9518e40104286a3034f3c3c688cd4ff9fbf

gh-readonly-queue/main/pr-34123-1c72b8d9db03b93b3fc7f86bc522e53806f5a8f0

gh-readonly-queue/main/pr-33960-38285aa1ac6de98614456f49b4d834fe503f4e58

p383

yanli/phase3-code-scope

test/workflow-app

codex/migrate-old-toast-calls-and-update-translations

hotfix/1.13.2-fix2

focal-quokka

codex/fix-issue-33422-in-repository

hotfix/1.13.2-fix1

copilot/refactor-test-config-leak-fix

build/release-1.13.2

fix-kpa-issue

build/release-1.13.1-rc.3

3-18-dev-with-http2

build/release-1.13.1-rc.2

3-16-revert-changes

3-16-add-csp

build/release-1.13.1-rc.1

feat/source-for-plugin-tasks

3-16-next-lib

revert-33484-dependabot/pip/api/python-packages-2eba66ec58

move-trigger-nodes

copilot/refactor-test-config-leak-detection

fix/enterprise-api-error-handling

release/e-1.12.1

fix/vinext-deps

yanli/docx-image-render

copilot/analyze-dify-code

deploy/clean-task-trace

copilot/sub-pr-33044

3-6-type-check

feat/model-provider-refactor

copilot/refactor-unnecessary-cast-call

build/export-app-messages

1.12.1-otel-ee

hotfix/1.13.0-fix.4

update-checker

test/ui-primitive-wrapper-tests-pr

hotfix/1.13.0-fix.3

refactor/base-comp

deploy/memory-usage

hotfix/1.13.0-fix.2

hotfix/1.13.0-fix.1

build/sandbox-clean-job-260302-1

build/sandbox-clean-job

fix/otel-upgrade-e-1.12.1

build/optimize-workflow-run-cleanup

move-core-prompt-runtime

hotfix/1.12.1-fix.6

copilot/remove-pm2-from-docker

move-token-buffer-memory

32589-main-repo

fix/access-mode-sso-verified

refactor/remove-workspace-mutate-from-context

2-11-fix-lint

feat/plugins-marketplace-ssr-prefetch-loading

build/message-clean-performance-log

refactor/template-transform-node

hotfix/1.12.1-fix.5

2-9-stable-test-2

pre-align-hitl-frontend

fix/preserve-UNC-paths-in-conversation-opner

hotfix/1.12.1-fix.4

hotfix/1.12.1-fix.3

feat/add-update-all-plugin-button

refactor/share

hotfix/1.12.1-fix.2

test/inprove-quality

feat/add_templates

hotfix/1.12.1-fix.1

fix/ee-1511-set-default-provider-user-id-bug

copilot/fix-pnpm-test

hotfix/1.12.1-fix.0

feat/vibe-wf

fix/fix-test

fix/console_ns_import

release/1.12.1

fix/workflow-sync-draft

refactor/ssr-prefetch-zustand-removal

1-24-kubb-generate

refactor/migrate-react-window-to-tanstack-virtual

fix/input-ime-onpressenter

1-30-fix-failed-test

feat/structured-output-with-sandbox

yanli/init-ty

hotfix/1.11.4-fix.4

fix/trigger-plugin-output

fix/parallel-generation-render

refactor/configuration

yanli/add-opaque-body

build/billing-refactor-test-2026012701

refactor/debug-and-preview-store

refactor/tools-workflow

build/debug-billing-refactor

build/billing-service

build-billing-service

feat/add-agentation

refactor/app-components

build/collaboration

copilot/sub-pr-31424

refactor/local-storage

refactor/skill-bundler

hotfix/1.11.4-fix.3

build/archive-workflow-run

feat/pull-a-variable

hotfix/1.11.4-fix.2

copilot/sub-pr-30849

hotfix/1.11.4-fix.1

1-21-test-window-is-not-defined

revert-30727-feat/model-total-credits

copilot/sub-pr-31283

zhsama/multi-turn-popup

zhsama/panel-var-popup

12-19-demo-for-app-store

refactor/migrate-app-detail-to-tanstack-query

build/clear-message

feat/credential-sync-fix-ee

feat/llm-first-token-timeout

zhsama/assemble-var-input

release/e-1.11.2

feature/task-quadrant-view

zhsama/llm-warning-ui

build/clear-workflow-run

zhsama/agent-at-nodes

build/1.11.4

release/e-1.6.0-fix.1

release/e-0.15.8-fix.1

1-14-remove-web-app-access-token

refactor/plugins-detail

fix/reset-dev

feat/llm-support-tools

feat/knowledge-summary-index

fix/preact-security-vulnerability

copilot/fix-clear-query-params-test

refactor/query-params-nuqs

chore/upgrade-pnpm-10.28.0

8c92-update-api-core

detached

chore/i18n-sync-20260107-104636

chore/i18n-sync-20260107-102654

feat/grouping-branching

feat/agent-node-v2

hotfix/1.11.2-fix.3

feat/llm-node-support-tools

refactor/remove-axios-dependency

refactor/web-service-hooks

fix/pwa-plugin-migration

chore/refactor-text-generation

hotfix/1.11.2-fix.2

release/e-1.11.1

release/e-1.9.2

release/e-1.8.2

hotfix/1.11.2-hotfix-1

refactor/chat-messages-service-api

fix/knowledge-retrieval-node-affected-by-past-version

fix/esbuild-dependabot-145

chore/automated-i18n-updates-02e0fadef78f0c888b79e7a52ae6714ac73effdc

chore/automated-i18n-updates-eb73f9a9b9fc9eee6be786d2bf5f41fc77e240c4

hotfix/1.11.1-2

refactor-text-generate-item

feat/end-user-oauth

feat/add-qdrant-to-tidb-migration

codex/run-pnpm-lint-fix-and-commit-changes

feat/document-test

feat/e2e-testing

deploy/trigger-dev

hotfix/1.11.1-1

e-260

refactor/use-log-react-query

feat/fallback-interface-for-unauthorized-datasource-node

hotfix/1.10.1-fix.4

refactor/app/components/app/text-generate/item/index.tsx-and-add-test

release/e-1.6.0

hotfix/1.10.1-fix.3

hotfix/1.10.1-fix.2

feat/tracking-1203

deploy/end-user-oauth

hotfix/1.10.1-fix.1

refactor/marketplace-react-query

feat/detect-cognitive-complexity

fix/codeowners

fix/httpx_timeout_parameters

feat/end-user-auth-dummy-apis

chore/re-point-doc-urls

fix/share-markdown-xss

feat/data-tracking

feat/memory-orchestration-be

build/trigger-billing

chore/remove-docker-legacy-dir

copilot/reverse-engineer-dify-application

feat/amplitude

feat/trigger-saas

mysql-adapt

test/build-diff-edition

feat/no-root-image

feat/trigger

feat/ga-tracking

feat/collaboration

mysql-adaptation

feat/sqlalchemy-type-annotations

build/trigger-1

build/self-tenant-queue

mcp-conditional-capability

fix/mcp-capability

hotfix/1.9.2-fix.3

hotfix/1.9.2-fix.2

feat/iteration-node

hotfix/1.9.2-fix.1

hotfix/1.9.1-fix.1

e1ca7a9bdb0443b9f027b6de16

fix/login-status

feat/gtag-1016

test/monaco-editor-and-remix-icon-upgrade

copilot/fix-ce7a9189-f70c-4ea9-81ba-3f49303104d6

feat/memory-orchestration-be-dev-env

build/trigger

feat/add-knowledge-pipeline-template-command

chore/workflow-performance

copilot/fix-fc039c44-aa24-4844-82b2-e9ac237a13e9

test/log-refactor

chore/ssrf-config

feat/pinecone-vdb

copilot/fix-d8c5989d-5a30-418f-8dc4-099cf1f37218

deploy/rag-dev

hotfix/1.9.0-fix.2

pinecone

fix/document-query

feat/trigger_backup

feat/playwright-integration

feat/trigger_merging

feat/chunk-deduplication

feat/crendential-policy-default-check

feat/credential-policy

release/e-1.8.1

fix/template-list

feat/end_user

feat/trigger-fe

revert-25628-refactor-24421-app-datasets-part1

fix/plugin-tag-fallback

fix/unselect-credential

feat/limit-conv-var-desc-length

feat/rag-pipeline-service-api

fix/empty-plugin-list

feat/plugin-readme

feat/plugin-readme-fe

feat/container-node-extract-mapping

bug1

fix/model-credential

feat/big-var-value-show-fe

build/1.7.2-fix.2

release/e-1.7.2

build/boolean-type

feat/oauth-provider-fe

build/0.7.2-fix.1

feat/model-credentials

feat/model-auth

feat/rag-2-preview

release/e-1.7.1

fix/hotfix-tool-provider-deadlock

feat/knowledge-pipeline-access-control

config-tool-file-size

13604-when-using-redis-cluster-for-caching-add-global_prefix-to-all-keys-cached-by-redis

feat/model-credentils

build/oauth

feat/oauth

feat/human-input

build/plugin-auto-upgrade

test/performance

feat/tool-plugin-oauth

feat/tool-oauth

temp-feat-owner-transfer-enterprise-frontend

release/e-3.0.2

feat/plugin-auto-upgrade-fe

chore/offline-the-sys-files

feat/rag-pipeline

feat/r2

release/e-3.2.0

wtw/rag-pipeline

feat/add-retrival-field-in-dataset

feat/webapp-verified-sso-main

fix/app-not-published-error

feat/webapp-verified-sso-260

v141-hotfix

fix/20326-tool-invoke-error-instance-account

fix/19933-account-object-has-no-attribute-_current_tenant-when-workflow-uses-workflow-as-tool-node

hotfix/0519

fix/e-legacy-clean-up

fix/admin-permission

fix/e-admin-permission

feat/model-memory

feat/webapp-auth-api

1.0.0-fix

revert-17133-fix/i16990-text-to-language-settings

e-0156

hotfix/translation-fix

fix/slider-style-error

e-0154

release/0.15.6-alpha-1

cohere/cleanup-free-tenants-logs

chore/auto-dify

fix/rag-infinity-spaces-loop

fix/dataset-admin

fix/expose-debugging-port

fix/tool-info

fix/aws-s3-r2-compatible

feat/knowledge-metabase

fix/fail-branch-stream-output-error

release/0.15.3-fix1

feat/14009-feature-request-support-for-retrieving-historical-conversations-without-from-enduser-id

feat/upgrade-unstructured-version-10.2

feat/classnames-sort

feat/upgrade-unstructured-version

fix/version-check

fix/handle-agent-none-value

fix/agent-params-pasring

fix/agent-parallel

feat/knowledge-dark-mode

feat/custom-tool-input

release/0.15.2-fix1

0.15.1-admin-apis

feat/support-docx-image-view

feat/agent-stream-output

feat/workflow-node-dark-mode

fix/switch-strategy-clean-param

fix/chore-fix

opik-monitoring

provider-gpustack

feat/mecab-japanese-keywords

feat/retry-single-step-debug

revert-12086-feat/parent-child-retrieval

fix/remove-the-retry-index-field

fix/11839

feat/node-execution-retry

feat/support-extractor-tools-update-wip

feat/update-tidb-batchget-endpoint

fix/iteration-thread-pool-error

feat/support-multi-token-count

feat/parent-child-retrieval-api

fix/app-icon-is-missing

feat/support-extractor-tools-update

test/disable_site

build/add-dependabot

feat/support-extractor-tools

fix/docx-extract-image-ssrf

fix/redis-slow-in-gevent

fix/9772-internal-server-error-when-custom-disclaimer-longer-than-64-characters

alert-autofix-89

build/eslint-react-refresh-plugin

build/switch-to-pnpm

revert-9424-feat/update-dataset-clean-rule

fix/external-knowledge-retrieval-issues

feat/login-type-coontrol

feat/external-knowledge-api

feat/rag-external-knowledge-with-api

feat/external-knowledge

fix/notion-table-extract

fix/tooltip

feat/workflow-add-block-shortcut

feat/update-docs

fix/note-node-zoom-issue

fix/model-runtime-quato-issue

fix/db-lock-timeout

feat/new-tooltip

feat/web-app-sso

chore/optimize-app-workflow-deletion-slow-sql

fix/trace_app_config_app_id_idx

fix/extra-table-tracing-app-config

feat/update-beat-job-time-to-env

fix/index-estimate-error

chore/enterprise-license-status

fix/remove-tsne_position

feat/2p

feat/aws-iam-auth-check

feat/add-flashrank

feat/support-milvus-2.4

feat/add-resource-from-tools

bai

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: langgenius/dify#20681