langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-23 13:05:55 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

After logging in, it automatically redirects back to the login page.“登录后，自动又跳回登录页” #20990

New Issue
Closed
opened 2026-02-21 20:10:08 -05:00 by yindo · 7 comments
yindo commented 2026-02-21 20:10:08 -05:00
Owner
Copy Link
Copy Source

Originally created by @Mr-piao on GitHub (Dec 11, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.11.0

Cloud or Self Hosted

Self Hosted (Source)

Steps to reproduce

登录后再次，退回到登录页，其中wordspace那个接口 报的401类似权限的问题，
After logging in, it redirects back to the login page again, and the wordspace endpoint returns a 401 error, indicating a permission-related issue.

✔️ Expected Behavior

登录后再次，退回到登录页，其中wordspace那个接口 报的401类似权限的问题，
After logging in, it redirects back to the login page again, and the wordspace endpoint returns a 401 error, indicating a permission-related issue.

❌ Actual Behavior

登录后再次，退回到登录页，其中wordspace那个接口 报的401类似权限的问题，
After logging in, it redirects back to the login page again, and the wordspace endpoint returns a 401 error, indicating a permission-related issue.

Originally created by @Mr-piao on GitHub (Dec 11, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.11.0 ### Cloud or Self Hosted Self Hosted (Source) ### Steps to reproduce 登录后再次，退回到登录页，其中wordspace那个接口 报的401类似权限的问题， After logging in, it redirects back to the login page again, and the wordspace endpoint returns a 401 error, indicating a permission-related issue. ### ✔️ Expected Behavior 登录后再次，退回到登录页，其中wordspace那个接口 报的401类似权限的问题， After logging in, it redirects back to the login page again, and the wordspace endpoint returns a 401 error, indicating a permission-related issue. ### ❌ Actual Behavior 登录后再次，退回到登录页，其中wordspace那个接口 报的401类似权限的问题， After logging in, it redirects back to the login page again, and the wordspace endpoint returns a 401 error, indicating a permission-related issue.
yindo added the 🐞 bug label 2026-02-21 20:10:08 -05:00
yindo closed this issue 2026-02-21 20:10:08 -05:00
yindo commented 2026-02-21 20:10:08 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 11, 2025):

Hi @Mr-piao! I'm Dosu and I’m helping the dify team.

This issue is almost always caused by a problem with authentication cookies or session validation. Dify sets access, refresh, and CSRF tokens as HTTP-only cookies during login, and the workspace endpoint requires these tokens to be present and valid. If the browser doesn't send these cookies back (often due to misconfigured cookie domain, missing Secure flag, or reverse proxy/HTTPS issues), every authenticated request will get a 401 and the frontend will redirect you back to login repeatedly (source).

Here’s a checklist to help you troubleshoot:

  1. Make sure your COOKIE_DOMAIN environment variable matches your frontend domain exactly (no leading dot, no mismatched subdomains).
  2. If you’re using HTTPS, ensure your reverse proxy (like Nginx) is forwarding the X-Forwarded-Proto header and that Dify is running with is_secure() returning True so cookies are set with the Secure flag.
  3. Check that your browser is actually receiving and sending the cookies after login (use browser dev tools, look for access_token, refresh_token, and csrf_token).
  4. If you recently upgraded or changed authentication settings, note that recent Dify versions added stricter session_id validation for JWTs (source). If the session_id in the token doesn’t match the expected user, you’ll get a 401.
  5. Make sure your user is a member of at least one workspace. If not, login will silently fail and you’ll be redirected (source).

If you’ve checked all of the above and still have issues, try enabling debug logs and inspecting the backend logs for authentication errors. This will usually point to a cookie, token, or session mismatch.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Dec 11, 2025): <!-- Greeting --> Hi @Mr-piao! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the dify team. <!-- Answer --> This issue is almost always caused by a problem with authentication cookies or session validation. Dify sets access, refresh, and CSRF tokens as HTTP-only cookies during login, and the workspace endpoint requires these tokens to be present and valid. If the browser doesn't send these cookies back (often due to misconfigured cookie domain, missing `Secure` flag, or reverse proxy/HTTPS issues), every authenticated request will get a 401 and the frontend will redirect you back to login repeatedly ([source](https://github.com/langgenius/dify/blob/193c8e2362132b6ebab75caa899c4e191ced8c03/api/libs/token.py#L33-L227)). Here’s a checklist to help you troubleshoot: 1. Make sure your `COOKIE_DOMAIN` environment variable matches your frontend domain exactly (no leading dot, no mismatched subdomains). 2. If you’re using HTTPS, ensure your reverse proxy (like Nginx) is forwarding the `X-Forwarded-Proto` header and that Dify is running with `is_secure()` returning `True` so cookies are set with the `Secure` flag. 3. Check that your browser is actually receiving and sending the cookies after login (use browser dev tools, look for `access_token`, `refresh_token`, and `csrf_token`). 4. If you recently upgraded or changed authentication settings, note that recent Dify versions added stricter session_id validation for JWTs ([source](https://github.com/langgenius/dify/pull/28297)). If the session_id in the token doesn’t match the expected user, you’ll get a 401. 5. Make sure your user is a member of at least one workspace. If not, login will silently fail and you’ll be redirected ([source](https://github.com/langgenius/dify/blob/193c8e2362132b6ebab75caa899c4e191ced8c03/api/controllers/console/auth/login.py#L75-L304)). If you’ve checked all of the above and still have issues, try enabling debug logs and inspecting the backend logs for authentication errors. This will usually point to a cookie, token, or session mismatch. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/6bb91041-9f23-4622-9c62-863c5f6f8ecd?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/6bb91041-9f23-4622-9c62-863c5f6f8ecd?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/6bb91041-9f23-4622-9c62-863c5f6f8ecd?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/6bb91041-9f23-4622-9c62-863c5f6f8ecd?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/6bb91041-9f23-4622-9c62-863c5f6f8ecd?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/6bb91041-9f23-4622-9c62-863c5f6f8ecd?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/6bb91041-9f23-4622-9c62-863c5f6f8ecd?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=This%20issue%20is%20almost%20always%20caused%20by%20a%20problem%20with%20authentication%20cookies%20or%20session%20validation.%20Dify%20sets%20access%2C%20refresh%2C%20and%20CSRF%20tokens%20as%20HTTP-only%20cookies%20during%20login%2C%20and%20the%20workspace%20endpoint%20requires%20these%20tokens%20to%20be%20present%20and%20valid.%20If%20the%20browser%20doesn%27t%20send%20these%20cookies%20back%20%28often%20due%20to%20misconfigured%20cookie%20domain%2C%20missing%20%60Secure%60%20flag%2C%20or%20reverse%20proxy/HTTPS%20issues%29%2C%20every%20authenticated%20request%20will%20get%20a%20401%20and%20the%20frontend%20will%20redirect%20you%20back%20to%20login%20repeatedly%20%28%5Bsource%5D%28https%3A//github.com/langgenius/dify/blob/193c8e2362132b6ebab75caa899c4e191ced8c03/api/libs/token.py%23L33-L227%29%29.%0A%0AHere%E2%80%99s%20a%20checklist%20to%20help%20you%20troubleshoot%3A%0A%0A1.%20Make%20sure%20your%20%60COOKIE_DOMAIN%60%20environment%20variable%20matches%20your%20frontend%20domain%20exactly%20%28no%20leading%20dot%2C%20no%20mismatched%20subdomains%29.%0A2.%20If%20you%E2%80%99re%20using%20HTTPS%2C%20ensure%20your%20reverse%20proxy%20%28like%20Nginx%29%20is%20forwarding%20the%20%60X-Forwarded-Proto%60%20header%20and%20that%20Dify%20is%20running%20with%20%60is_secure%28%29%60%20returning%20%60True%60%20so%20cookies%20are%20set%20with%20the%20%60Secure%60%20flag.%0A3.%20Check%20that%20your%20browser%20is%20actually%20receiving%20and%20sending%20the%20cookies%20after%20login%20%28use%20browser%20dev%20tools%2C%20look%20for%20%60access_token%60%2C%20%60refresh_token%60%2C%20and%20%60csrf_token%60%29.%0A4.%20If%20you%20recently%20upgraded%20or%20changed%20authentication%20settings%2C%20note%20that%20recent%20Dify%20versions%20added%20stricter%20session_id%20validation%20for%20JWTs%20%28%5Bsource%5D%28https%3A//github.com/langgenius/dify/pull/28297%29%29.%20If%20the%20session_id%20in%20the%20token%20doesn%E2%80%99t%20match%20the%20expected%20user%2C%20you%E2%80%99ll%20get%20a%20401.%0A5.%20Make%20sure%20your%20user%20is%20a%20member%20of%20at%20least%20one%20workspace.%20If%20not%2C%20login%20will%20silently%20fail%20and%20you%E2%80%99ll%20be%20redirected%20%28%5Bsource%5D%28https%3A//github.com/langgenius/dify/blob/193c8e2362132b6ebab75caa899c4e191ced8c03/api/controllers/console/auth/login.py%23L75-L304%29%29.%0A%0AIf%20you%E2%80%99ve%20checked%20all%20of%20the%20above%20and%20still%20have%20issues%2C%20try%20enabling%20debug%20logs%20and%20inspecting%20the%20backend%20logs%20for%20authentication%20errors.%20This%20will%20usually%20point%20to%20a%20cookie%2C%20token%2C%20or%20session%20mismatch.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/29544)
yindo commented 2026-02-21 20:10:08 -05:00
Author
Owner
Copy Link
Copy Source

@Mr-piao commented on GitHub (Dec 11, 2025):

401 unauthorized 报的这个错，如果可以的话，你们在read.me里直接写清楚多好

@Mr-piao commented on GitHub (Dec 11, 2025): 401 unauthorized 报的这个错，如果可以的话，你们在read.me里直接写清楚多好
yindo commented 2026-02-21 20:10:09 -05:00
Author
Owner
Copy Link
Copy Source

@timmymhfan-eclass commented on GitHub (Dec 11, 2025):

这个错误看到好多了，issue下面有些写了fix，但是没有人说怎么fix，environment加了
CONSOLE_API_URL=https://domain.com
CONSOLE_WEB_URL=https://domain.com
COOKIE_DOMAIN=https://domain.com
NEXT_PUBLIC_COOKIE_DOMAIN=1
还是一样401

@timmymhfan-eclass commented on GitHub (Dec 11, 2025): 这个错误看到好多了，issue下面有些写了fix，但是没有人说怎么fix，environment加了 CONSOLE_API_URL=https://domain.com CONSOLE_WEB_URL=https://domain.com COOKIE_DOMAIN=https://domain.com NEXT_PUBLIC_COOKIE_DOMAIN=1 还是一样401
yindo commented 2026-02-21 20:10:09 -05:00
Author
Owner
Copy Link
Copy Source

@Mr-piao commented on GitHub (Dec 11, 2025):

CONSOLE_API_URL

这个错误看到好多了，issue下面有些写了fix，但是没有人说怎么fix，environment加了 CONSOLE_API_URL=https://domain.com CONSOLE_WEB_URL=https://domain.com COOKIE_DOMAIN=https://domain.com NEXT_PUBLIC_COOKIE_DOMAIN=1 还是一样401

NEXT_PUBLIC_API_PREFIX=http://192.168.18.75:5001/console/api

The URL for Web APP, refers to the Web App base URL of WEB service if web app domain is different from

console or api domain.

example: http://udify.app/api

NEXT_PUBLIC_PUBLIC_API_PREFIX=http://192.168.18.75:5001/api

When the frontend and backend run on different subdomains, set NEXT_PUBLIC_COOKIE_DOMAIN=1.

NEXT_PUBLIC_COOKIE_DOMAIN=

我这么写也没好使

@Mr-piao commented on GitHub (Dec 11, 2025): CONSOLE_API_URL > 这个错误看到好多了，issue下面有些写了fix，但是没有人说怎么fix，environment加了 CONSOLE_API_URL=https://domain.com CONSOLE_WEB_URL=https://domain.com COOKIE_DOMAIN=https://domain.com NEXT_PUBLIC_COOKIE_DOMAIN=1 还是一样401 NEXT_PUBLIC_API_PREFIX=http://192.168.18.75:5001/console/api # The URL for Web APP, refers to the Web App base URL of WEB service if web app domain is different from # console or api domain. # example: http://udify.app/api NEXT_PUBLIC_PUBLIC_API_PREFIX=http://192.168.18.75:5001/api # When the frontend and backend run on different subdomains, set NEXT_PUBLIC_COOKIE_DOMAIN=1. NEXT_PUBLIC_COOKIE_DOMAIN= 我这么写也没好使
yindo commented 2026-02-21 20:10:09 -05:00
Author
Owner
Copy Link
Copy Source

@timmymhfan-eclass commented on GitHub (Dec 11, 2025):

@crazywoola 哥咋直接close了，issue看了一些都说fix了，但是没看到说真正解决了。还是说下个版本会修复或者有文档啥的？又或者说我们env添加都是错误的？实际上并不能解决问题？

@timmymhfan-eclass commented on GitHub (Dec 11, 2025): @crazywoola 哥咋直接close了，issue看了一些都说fix了，但是没看到说真正解决了。还是说下个版本会修复或者有文档啥的？又或者说我们env添加都是错误的？实际上并不能解决问题？
yindo commented 2026-02-21 20:10:09 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Dec 14, 2025):

【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）

@crazywoola commented on GitHub (Dec 14, 2025): 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
yindo commented 2026-02-21 20:10:09 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Dec 14, 2025):

https://github.com/langgenius/dify/blob/dbecba710b6ea82c9427da53edff971c013a4afa/CONTRIBUTING.md#L23-L33

@crazywoola commented on GitHub (Dec 14, 2025): https://github.com/langgenius/dify/blob/dbecba710b6ea82c9427da53edff971c013a4afa/CONTRIBUTING.md#L23-L33
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#20990
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?