langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-20 19:50:06 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Error 403 occurred when using CDN. #21152

New Issue
Closed
opened 2026-02-21 20:11:10 -05:00 by yindo · 4 comments
yindo commented 2026-02-21 20:11:10 -05:00
Owner
Copy Link
Copy Source

Originally created by @MisinGuo on GitHub (Dec 18, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.11.1

Cloud or Self Hosted

Self Hosted (Source)

Steps to reproduce

I deployed it directly on the server using Docker and exposed it on port 3080. Everything worked fine when I accessed it directly via the IP address.

Next, I was supposed to access it using a CDN, so I used EdgeOne edge computing CDN to forward the HTTP (port 3080).

According to the instructions, I needed to configure the following items (CONSOLE_API_URL, CONSOLE_WEB_URL, SERVICE_API_URL, APP_API_URL, APP_WEB_URL) to my production domain.

Then I was supposed to make a request to https://mydomain.com/install to initialize it. The first initialization was successful, but afterwards it would redirect me to the current initialization page for a second initialization. However, when I initialized it again, it started throwing errors.

✔️ Expected Behavior

It should redirect me to the login page so I can log in to the backend.

❌ Actual Behavior

The first time, I can normally access the page and set up the administrator account, but it does not redirect afterward. Instead, it keeps throwing errors on this page, with the following message:

“Dify has been successfully installed. Please refresh the page or return to the dashboard homepage.”
Image

Originally created by @MisinGuo on GitHub (Dec 18, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.11.1 ### Cloud or Self Hosted Self Hosted (Source) ### Steps to reproduce I deployed it directly on the server using Docker and exposed it on port 3080. Everything worked fine when I accessed it directly via the IP address. Next, I was supposed to access it using a CDN, so I used EdgeOne edge computing CDN to forward the HTTP (port 3080). According to the instructions, I needed to configure the following items (CONSOLE_API_URL, CONSOLE_WEB_URL, SERVICE_API_URL, APP_API_URL, APP_WEB_URL) to my production domain. Then I was supposed to make a request to https://mydomain.com/install to initialize it. The first initialization was successful, but afterwards it would redirect me to the current initialization page for a second initialization. However, when I initialized it again, it started throwing errors. ### ✔️ Expected Behavior It should redirect me to the login page so I can log in to the backend. ### ❌ Actual Behavior The first time, I can normally access the page and set up the administrator account, but it does not redirect afterward. Instead, it keeps throwing errors on this page, with the following message: “Dify has been successfully installed. Please refresh the page or return to the dashboard homepage.” <img width="2557" height="1440" alt="Image" src="https://github.com/user-attachments/assets/b1681cc9-8bab-49cb-86d0-017adb5fccfc" />
yindo added the 🐞 bugwont-fix labels 2026-02-21 20:11:10 -05:00
yindo closed this issue 2026-02-21 20:11:10 -05:00
yindo commented 2026-02-21 20:11:10 -05:00
Author
Owner
Copy Link
Copy Source

@MisinGuo commented on GitHub (Dec 18, 2025):

Below is the API error:

Request URL:
https://mydomain.com/console/api/setup

Request Method:
POST

Status Code:
403 Forbidden

Remote Address:
127.0.0.1:10809

Referrer Policy:
strict-origin-when-cross-origin

Response Headers:

access-control-allow-credentials: true

access-control-allow-origin: https://mydomain..com/

access-control-expose-headers: X-Env, X-Trace-Id, X-Version

content-length: 149

content-type: application/json

date: Thu, 18 Dec 2025 11:01:46 GMT

eo-cache-status: MISS

eo-log-uuid: 9578250861021898280

nel: {"success_fraction":0.1,"report_to":"eo-nel","max_age":604800}

report-to: {"endpoints":[{"url":"https://nel.teo-rum.com/eo-cgi/nel"}],"group":"eo-nel","max_age":604800
}

server: nginx/1.29.4

vary: Origin

x-env: PRODUCTION

x-version: 1.11.1

@MisinGuo commented on GitHub (Dec 18, 2025): Below is the API error: Request URL: https://mydomain.com/console/api/setup Request Method: POST Status Code: 403 Forbidden Remote Address: 127.0.0.1:10809 Referrer Policy: strict-origin-when-cross-origin Response Headers: access-control-allow-credentials: true access-control-allow-origin: https://mydomain..com/ access-control-expose-headers: X-Env, X-Trace-Id, X-Version content-length: 149 content-type: application/json date: Thu, 18 Dec 2025 11:01:46 GMT eo-cache-status: MISS eo-log-uuid: 9578250861021898280 nel: {"success_fraction":0.1,"report_to":"eo-nel","max_age":604800} report-to: {"endpoints":[{"url":"https://nel.teo-rum.com/eo-cgi/nel"}],"group":"eo-nel","max_age":604800 } server: nginx/1.29.4 vary: Origin x-env: PRODUCTION x-version: 1.11.1
yindo commented 2026-02-21 20:11:11 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 18, 2025):

Hi @MisinGuo! I'm Dosu and I’m helping the dify team.

The 403 error on the /console/api/setup endpoint means Dify has already been initialized and is blocking repeated setup attempts by design—this is confirmed by the backend logic, which raises an error once an admin account exists "source". The message you see is expected after the first successful install.

However, the redirect loop and the malformed access-control-allow-origin header (with a double dot) suggest a misconfiguration in your environment variables or CDN setup. Make sure all relevant variables (CONSOLE_API_URL, CONSOLE_WEB_URL, SERVICE_API_URL, APP_API_URL, APP_WEB_URL) are set to your actual public domain (the one exposed by the CDN), with no typos or extra dots "source". Also, check that your CDN forwards the correct Origin and authentication headers and does not rewrite or corrupt them.

After correcting any configuration issues, clear your browser cache/cookies and restart your Docker containers. If the problem persists, check your backend logs for more details and share them for further troubleshooting.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Dec 18, 2025): <!-- Greeting --> Hi @MisinGuo! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the dify team. <!-- Answer --> The 403 error on the /console/api/setup endpoint means Dify has already been initialized and is blocking repeated setup attempts by design—this is confirmed by the backend logic, which raises an error once an admin account exists ["source"](https://github.com/langgenius/dify/blob/c12f0d16bb20572906faf19e0eba85528756b110/api/controllers/console/error.py#L4-L7). The message you see is expected after the first successful install. However, the redirect loop and the malformed access-control-allow-origin header (with a double dot) suggest a misconfiguration in your environment variables or CDN setup. Make sure all relevant variables (CONSOLE_API_URL, CONSOLE_WEB_URL, SERVICE_API_URL, APP_API_URL, APP_WEB_URL) are set to your actual public domain (the one exposed by the CDN), with no typos or extra dots ["source"](https://github.com/langgenius/dify/issues/26796). Also, check that your CDN forwards the correct Origin and authentication headers and does not rewrite or corrupt them. After correcting any configuration issues, clear your browser cache/cookies and restart your Docker containers. If the problem persists, check your backend logs for more details and share them for further troubleshooting. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/842cdb4b-2331-4e16-820a-5cbc90e69528?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/842cdb4b-2331-4e16-820a-5cbc90e69528?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/842cdb4b-2331-4e16-820a-5cbc90e69528?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/842cdb4b-2331-4e16-820a-5cbc90e69528?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/842cdb4b-2331-4e16-820a-5cbc90e69528?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/842cdb4b-2331-4e16-820a-5cbc90e69528?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/842cdb4b-2331-4e16-820a-5cbc90e69528?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=The%20403%20error%20on%20the%20/console/api/setup%20endpoint%20means%20Dify%20has%20already%20been%20initialized%20and%20is%20blocking%20repeated%20setup%20attempts%20by%20design%E2%80%94this%20is%20confirmed%20by%20the%20backend%20logic%2C%20which%20raises%20an%20error%20once%20an%20admin%20account%20exists%20%5B%22source%22%5D%28https%3A//github.com/langgenius/dify/blob/c12f0d16bb20572906faf19e0eba85528756b110/api/controllers/console/error.py%23L4-L7%29.%20The%20message%20you%20see%20is%20expected%20after%20the%20first%20successful%20install.%0A%0AHowever%2C%20the%20redirect%20loop%20and%20the%20malformed%20access-control-allow-origin%20header%20%28with%20a%20double%20dot%29%20suggest%20a%20misconfiguration%20in%20your%20environment%20variables%20or%20CDN%20setup.%20Make%20sure%20all%20relevant%20variables%20%28CONSOLE_API_URL%2C%20CONSOLE_WEB_URL%2C%20SERVICE_API_URL%2C%20APP_API_URL%2C%20APP_WEB_URL%29%20are%20set%20to%20your%20actual%20public%20domain%20%28the%20one%20exposed%20by%20the%20CDN%29%2C%20with%20no%20typos%20or%20extra%20dots%20%5B%22source%22%5D%28https%3A//github.com/langgenius/dify/issues/26796%29.%20Also%2C%20check%20that%20your%20CDN%20forwards%20the%20correct%20Origin%20and%20authentication%20headers%20and%20does%20not%20rewrite%20or%20corrupt%20them.%0A%0AAfter%20correcting%20any%20configuration%20issues%2C%20clear%20your%20browser%20cache/cookies%20and%20restart%20your%20Docker%20containers.%20If%20the%20problem%20persists%2C%20check%20your%20backend%20logs%20for%20more%20details%20and%20share%20them%20for%20further%20troubleshooting.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/29882)
yindo commented 2026-02-21 20:11:11 -05:00
Author
Owner
Copy Link
Copy Source

@MisinGuo commented on GitHub (Dec 18, 2025):

Yes, after further investigation, I found that the CDN might be blocking the proxy I was using. So I turned off my VPN and when I requested again, it kept redirecting between two pages: https://mydomain.com/signin and https://mydomain.com/apps
@dosu

@MisinGuo commented on GitHub (Dec 18, 2025): Yes, after further investigation, I found that the CDN might be blocking the proxy I was using. So I turned off my VPN and when I requested again, it kept redirecting between two pages: https://mydomain.com/signin and https://mydomain.com/apps [@dosu](https://go.dosu.dev/dosubot)
yindo commented 2026-02-21 20:11:11 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 18, 2025):

A redirect loop between /signin and /apps almost always means the authentication/session cookies aren't being set or recognized, often due to CDN or proxy misconfiguration. This can happen if the CDN is stripping or altering headers/cookies, or if environment variables like CONSOLE_API_URL/CONSOLE_WEB_URL don't exactly match your public domain (no typos, no extra dots, and using https if needed) "source".

Check in your browser dev tools if the access, refresh, and CSRF cookies are being set and sent for your domain during the loop. Also, review your CDN and nginx config to ensure all headers and cookies are forwarded as-is, and that no CDN features (like header rewriting, caching, or SameSite/secure flag changes) interfere with authentication. Setting RESPECT_XFORWARD_HEADERS_ENABLED=true in your backend .env is recommended for correct URL generation behind proxies.

If you use a custom basePath or subpath, make sure all manual redirect URLs in the frontend use the basePath variable, and rebuild the frontend after any changes. If the problem persists, try stopping all Docker containers, removing volumes (app, db, redis, weaviate), and restarting to reset the application state "source".

If you can, share a screenshot of your browser's cookies and network tab during the redirect loop—this will help pinpoint if cookies are missing or invalid.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Dec 18, 2025): <!-- Answer --> A redirect loop between /signin and /apps almost always means the authentication/session cookies aren't being set or recognized, often due to CDN or proxy misconfiguration. This can happen if the CDN is stripping or altering headers/cookies, or if environment variables like CONSOLE_API_URL/CONSOLE_WEB_URL don't exactly match your public domain (no typos, no extra dots, and using https if needed) ["source"](https://github.com/langgenius/dify/issues/23055#issuecomment-3194845177). Check in your browser dev tools if the access, refresh, and CSRF cookies are being set and sent for your domain during the loop. Also, review your CDN and nginx config to ensure all headers and cookies are forwarded as-is, and that no CDN features (like header rewriting, caching, or SameSite/secure flag changes) interfere with authentication. Setting RESPECT_XFORWARD_HEADERS_ENABLED=true in your backend .env is recommended for correct URL generation behind proxies. If you use a custom basePath or subpath, make sure all manual redirect URLs in the frontend use the basePath variable, and rebuild the frontend after any changes. If the problem persists, try stopping all Docker containers, removing volumes (app, db, redis, weaviate), and restarting to reset the application state ["source"](https://github.com/langgenius/dify/issues/13137). If you can, share a screenshot of your browser's cookies and network tab during the redirect loop—this will help pinpoint if cookies are missing or invalid. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/4c249ece-1da8-4813-8c7d-bd5e3282554c?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/4c249ece-1da8-4813-8c7d-bd5e3282554c?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/4c249ece-1da8-4813-8c7d-bd5e3282554c?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/4c249ece-1da8-4813-8c7d-bd5e3282554c?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/4c249ece-1da8-4813-8c7d-bd5e3282554c?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/4c249ece-1da8-4813-8c7d-bd5e3282554c?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/4c249ece-1da8-4813-8c7d-bd5e3282554c?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=A%20redirect%20loop%20between%20/signin%20and%20/apps%20almost%20always%20means%20the%20authentication/session%20cookies%20aren%27t%20being%20set%20or%20recognized%2C%20often%20due%20to%20CDN%20or%20proxy%20misconfiguration.%20This%20can%20happen%20if%20the%20CDN%20is%20stripping%20or%20altering%20headers/cookies%2C%20or%20if%20environment%20variables%20like%20CONSOLE_API_URL/CONSOLE_WEB_URL%20don%27t%20exactly%20match%20your%20public%20domain%20%28no%20typos%2C%20no%20extra%20dots%2C%20and%20using%20https%20if%20needed%29%20%5B%22source%22%5D%28https%3A//github.com/langgenius/dify/issues/23055%23issuecomment-3194845177%29.%0A%0ACheck%20in%20your%20browser%20dev%20tools%20if%20the%20access%2C%20refresh%2C%20and%20CSRF%20cookies%20are%20being%20set%20and%20sent%20for%20your%20domain%20during%20the%20loop.%20Also%2C%20review%20your%20CDN%20and%20nginx%20config%20to%20ensure%20all%20headers%20and%20cookies%20are%20forwarded%20as-is%2C%20and%20that%20no%20CDN%20features%20%28like%20header%20rewriting%2C%20caching%2C%20or%20SameSite/secure%20flag%20changes%29%20interfere%20with%20authentication.%20Setting%20RESPECT_XFORWARD_HEADERS_ENABLED%3Dtrue%20in%20your%20backend%20.env%20is%20recommended%20for%20correct%20URL%20generation%20behind%20proxies.%0A%0AIf%20you%20use%20a%20custom%20basePath%20or%20subpath%2C%20make%20sure%20all%20manual%20redirect%20URLs%20in%20the%20frontend%20use%20the%20basePath%20variable%2C%20and%20rebuild%20the%20frontend%20after%20any%20changes.%20If%20the%20problem%20persists%2C%20try%20stopping%20all%20Docker%20containers%2C%20removing%20volumes%20%28app%2C%20db%2C%20redis%2C%20weaviate%29%2C%20and%20restarting%20to%20reset%20the%20application%20state%20%5B%22source%22%5D%28https%3A//github.com/langgenius/dify/issues/13137%29.%0A%0AIf%20you%20can%2C%20share%20a%20screenshot%20of%20your%20browser%27s%20cookies%20and%20network%20tab%20during%20the%20redirect%20loop%E2%80%94this%20will%20help%20pinpoint%20if%20cookies%20are%20missing%20or%20invalid.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/29882)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label wont-fix 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#21152
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?