langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 12:05:30 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

CORS subject running error when embed ANY BOT TO other WEBSITES #21399

New Issue
Closed
opened 2026-02-21 20:12:23 -05:00 by yindo · 6 comments
yindo commented 2026-02-21 20:12:23 -05:00
Owner
Copy Link
Copy Source

Originally created by @tnfsmith on GitHub (Dec 31, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.11.2

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

Hi there, after several update from 1.10.0 and then 1.11.2. the CORS subject running error when embed ANY BOT TO OUTSIDE THE HOST WEBSITE. I always get error message "connection refuse" with a bot embed html code to this website. Previous, it still works fine. I try to imply to add certain domain to .env file and rerun the docker but error still existed. I try many ways and get help from AI instruction but still failed to config bot outside.
I try both Chatbot and Chatflow

✔️ Expected Behavior

Should display a bot form interact with user

❌ Actual Behavior

connection was refuse

Image
Originally created by @tnfsmith on GitHub (Dec 31, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.11.2 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce Hi there, after several update from 1.10.0 and then 1.11.2. the CORS subject running error when embed ANY BOT TO OUTSIDE THE HOST WEBSITE. I always get error message "connection refuse" with a bot embed html code to this website. Previous, it still works fine. I try to imply to add certain domain to .env file and rerun the docker but error still existed. I try many ways and get help from AI instruction but still failed to config bot outside. I try both Chatbot and Chatflow ### ✔️ Expected Behavior Should display a bot form interact with user ### ❌ Actual Behavior connection was refuse <img width="483" height="678" alt="Image" src="https://github.com/user-attachments/assets/16cb55f6-6d61-40d4-aded-206849243b74" />
yindo added the 🐞 bug label 2026-02-21 20:12:23 -05:00
yindo closed this issue 2026-02-21 20:12:23 -05:00
yindo commented 2026-02-21 20:12:24 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 31, 2025):

For Dify 1.11.2 self-hosted via Docker, embedding bots on external websites requires correct CORS and embedding configuration. Here’s what to check:

  1. In your .env file, set both WEB_API_CORS_ALLOW_ORIGINS and CONSOLE_CORS_ALLOW_ORIGINS to include the full URLs of all domains where you want to embed the bot (e.g., https://your-website.com). You can separate multiple domains with commas. The default (http://localhost:3000,*) allows all origins, but if you’ve restricted it, make sure your external domains are listed.
    Reference

  2. Set ALLOW_EMBED=true in your .env file to permit embedding. By default, this is false, which can block embeds for clickjacking protection.
    Reference

  3. In your docker-compose.yaml, ensure the API service exposes port 5001 to the host. Under the relevant service, add:

    ports:
  - "5001:5001"

    This is required for external sites to reach the API; otherwise, you’ll get “connection refused” errors.
    Reference

  4. After making these changes, restart your Docker containers to apply the new settings.

If you still see errors, check your browser’s console/network logs for CORS or network errors, and confirm there’s no reverse proxy or firewall blocking requests. If your embed code or API endpoints use localhost or 127.0.0.1, replace them with your server’s actual IP or domain—Docker containers can’t resolve localhost as the host machine from outside.
Reference

Recent Dify updates made CORS config stricter and fully environment-variable-driven, so these settings are now critical for embedding to work.
Reference

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Dec 31, 2025): <!-- Answer --> For Dify 1.11.2 self-hosted via Docker, embedding bots on external websites requires correct CORS and embedding configuration. Here’s what to check: 1. In your `.env` file, set both `WEB_API_CORS_ALLOW_ORIGINS` and `CONSOLE_CORS_ALLOW_ORIGINS` to include the full URLs of all domains where you want to embed the bot (e.g., `https://your-website.com`). You can separate multiple domains with commas. The default (`http://localhost:3000,*`) allows all origins, but if you’ve restricted it, make sure your external domains are listed. [Reference](https://github.com/langgenius/dify/blob/ee1d0df927b8b64baf835b9df1e7aaba62c2cb2c/api/.env.example#L174-L651) 2. Set `ALLOW_EMBED=true` in your `.env` file to permit embedding. By default, this is `false`, which can block embeds for clickjacking protection. [Reference](https://github.com/langgenius/dify/blob/ee1d0df927b8b64baf835b9df1e7aaba62c2cb2c/api/.env.example#L174-L651) 3. In your `docker-compose.yaml`, ensure the API service exposes port 5001 to the host. Under the relevant service, add: ``` ports: - "5001:5001" ``` This is required for external sites to reach the API; otherwise, you’ll get “connection refused” errors. [Reference](https://github.com/langgenius/dify-official-plugins/issues/1816) 4. After making these changes, restart your Docker containers to apply the new settings. If you still see errors, check your browser’s console/network logs for CORS or network errors, and confirm there’s no reverse proxy or firewall blocking requests. If your embed code or API endpoints use `localhost` or `127.0.0.1`, replace them with your server’s actual IP or domain—Docker containers can’t resolve `localhost` as the host machine from outside. [Reference](https://github.com/langgenius/dify-official-plugins/issues/1127) Recent Dify updates made CORS config stricter and fully environment-variable-driven, so these settings are now critical for embedding to work. [Reference](https://github.com/langgenius/dify/pull/29440) <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/3e4df5bc-154a-47f0-8992-3d66e8078b96?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/3e4df5bc-154a-47f0-8992-3d66e8078b96?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/3e4df5bc-154a-47f0-8992-3d66e8078b96?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/3e4df5bc-154a-47f0-8992-3d66e8078b96?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/3e4df5bc-154a-47f0-8992-3d66e8078b96?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/3e4df5bc-154a-47f0-8992-3d66e8078b96?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/3e4df5bc-154a-47f0-8992-3d66e8078b96?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=For%20Dify%201.11.2%20self-hosted%20via%20Docker%2C%20embedding%20bots%20on%20external%20websites%20requires%20correct%20CORS%20and%20embedding%20configuration.%20Here%E2%80%99s%20what%20to%20check%3A%0A%0A1.%20In%20your%20%60.env%60%20file%2C%20set%20both%20%60WEB_API_CORS_ALLOW_ORIGINS%60%20and%20%60CONSOLE_CORS_ALLOW_ORIGINS%60%20to%20include%20the%20full%20URLs%20of%20all%20domains%20where%20you%20want%20to%20embed%20the%20bot%20%28e.g.%2C%20%60https%3A//your-website.com%60%29.%20You%20can%20separate%20multiple%20domains%20with%20commas.%20The%20default%20%28%60http%3A//localhost%3A3000%2C%2A%60%29%20allows%20all%20origins%2C%20but%20if%20you%E2%80%99ve%20restricted%20it%2C%20make%20sure%20your%20external%20domains%20are%20listed.%20%20%0A%20%20%20%5BReference%5D%28https%3A//github.com/langgenius/dify/blob/ee1d0df927b8b64baf835b9df1e7aaba62c2cb2c/api/.env.example%23L174-L651%29%0A%0A2.%20Set%20%60ALLOW_EMBED%3Dtrue%60%20in%20your%20%60.env%60%20file%20to%20permit%20embedding.%20By%20default%2C%20this%20is%20%60false%60%2C%20which%20can%20block%20embeds%20for%20clickjacking%20protection.%20%20%0A%20%20%20%5BReference%5D%28https%3A//github.com/langgenius/dify/blob/ee1d0df927b8b64baf835b9df1e7aaba62c2cb2c/api/.env.example%23L174-L651%29%0A%0A3.%20In%20your%20%60docker-compose.yaml%60%2C%20ensure%20the%20API%20service%20exposes%20port%205001%20to%20the%20host.%20Under%20the%20relevant%20service%2C%20add%3A%0A%20%20%20%60%60%60%0A%20%20%20ports%3A%0A%20%20%20%20%20-%20%225001%3A5001%22%0A%20%20%20%60%60%60%0A%20%20%20This%20is%20required%20for%20external%20sites%20to%20reach%20the%20API%3B%20otherwise%2C%20you%E2%80%99ll%20get%20%E2%80%9Cconnection%20refused%E2%80%9D%20errors.%20%20%0A%20%20%20%5BReference%5D%28https%3A//github.com/langgenius/dify-official-plugins/issues/1816%29%0A%0A4.%20After%20making%20these%20changes%2C%20restart%20your%20Docker%20containers%20to%20apply%20the%20new%20settings.%0A%0AIf%20you%20still%20see%20errors%2C%20check%20your%20browser%E2%80%99s%20console/network%20logs%20for%20CORS%20or%20network%20errors%2C%20and%20confirm%20there%E2%80%99s%20no%20reverse%20proxy%20or%20firewall%20blocking%20requests.%20If%20your%20embed%20code%20or%20API%20endpoints%20use%20%60localhost%60%20or%20%60127.0.0.1%60%2C%20replace%20them%20with%20your%20server%E2%80%99s%20actual%20IP%20or%20domain%E2%80%94Docker%20containers%20can%E2%80%99t%20resolve%20%60localhost%60%20as%20the%20host%20machine%20from%20outside.%20%20%0A%5BReference%5D%28https%3A//github.com/langgenius/dify-official-plugins/issues/1127%29%0A%0ARecent%20Dify%20updates%20made%20CORS%20config%20stricter%20and%20fully%20environment-variable-driven%2C%20so%20these%20settings%20are%20now%20critical%20for%20embedding%20to%20work.%20%20%0A%5BReference%5D%28https%3A//github.com/langgenius/dify/pull/29440%29)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/30440)
yindo commented 2026-02-21 20:12:24 -05:00
Author
Owner
Copy Link
Copy Source

@tnfsmith commented on GitHub (Dec 31, 2025):

The console browser show that error: "Refused to display 'https://app.mydomain.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.". I also set all the ways but not work at all. Consider revise this strict policy working correctly as I setup in the .env file

@tnfsmith commented on GitHub (Dec 31, 2025): The console browser show that error: "Refused to display 'https://app.mydomain.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.". I also set all the ways but not work at all. Consider revise this strict policy working correctly as I setup in the .env file
yindo commented 2026-02-21 20:12:24 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 31, 2025):

The X-Frame-Options header is blocking embedding because, by default, Dify's frontend sets this header to DENY or SAMEORIGIN for most routes, regardless of your backend .env settings like ALLOW_EMBED. To allow embedding on external sites, you need to set NEXT_PUBLIC_ALLOW_EMBED=true in your frontend environment (typically in web/.env), then rebuild and restart your frontend service. This will remove the restrictive header and let your app be embedded in iframes on other domains. Make sure your iframe src uses HTTPS, and that your frontend and backend are on the same top-level domain if you need shared authentication cookies. For more details, see this discussion and middleware implementation.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Dec 31, 2025): <!-- Answer --> The X-Frame-Options header is blocking embedding because, by default, Dify's frontend sets this header to DENY or SAMEORIGIN for most routes, regardless of your backend .env settings like ALLOW_EMBED. To allow embedding on external sites, you need to set NEXT_PUBLIC_ALLOW_EMBED=true in your frontend environment (typically in web/.env), then rebuild and restart your frontend service. This will remove the restrictive header and let your app be embedded in iframes on other domains. Make sure your iframe src uses HTTPS, and that your frontend and backend are on the same top-level domain if you need shared authentication cookies. For more details, see [this discussion](https://github.com/langgenius/dify/issues/25790) and [middleware implementation](https://github.com/langgenius/dify/issues/25790). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/f651afe0-0aad-462c-ab25-04088bd23a3f?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/f651afe0-0aad-462c-ab25-04088bd23a3f?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/f651afe0-0aad-462c-ab25-04088bd23a3f?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/f651afe0-0aad-462c-ab25-04088bd23a3f?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/f651afe0-0aad-462c-ab25-04088bd23a3f?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/f651afe0-0aad-462c-ab25-04088bd23a3f?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/f651afe0-0aad-462c-ab25-04088bd23a3f?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=The%20X-Frame-Options%20header%20is%20blocking%20embedding%20because%2C%20by%20default%2C%20Dify%27s%20frontend%20sets%20this%20header%20to%20DENY%20or%20SAMEORIGIN%20for%20most%20routes%2C%20regardless%20of%20your%20backend%20.env%20settings%20like%20ALLOW_EMBED.%20To%20allow%20embedding%20on%20external%20sites%2C%20you%20need%20to%20set%20NEXT_PUBLIC_ALLOW_EMBED%3Dtrue%20in%20your%20frontend%20environment%20%28typically%20in%20web/.env%29%2C%20then%20rebuild%20and%20restart%20your%20frontend%20service.%20This%20will%20remove%20the%20restrictive%20header%20and%20let%20your%20app%20be%20embedded%20in%20iframes%20on%20other%20domains.%20Make%20sure%20your%20iframe%20src%20uses%20HTTPS%2C%20and%20that%20your%20frontend%20and%20backend%20are%20on%20the%20same%20top-level%20domain%20if%20you%20need%20shared%20authentication%20cookies.%20For%20more%20details%2C%20see%20%5Bthis%20discussion%5D%28https%3A//github.com/langgenius/dify/issues/25790%29%20and%20%5Bmiddleware%20implementation%5D%28https%3A//github.com/langgenius/dify/issues/25790%29.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/30440)
yindo commented 2026-02-21 20:12:24 -05:00
Author
Owner
Copy Link
Copy Source

@tnfsmith commented on GitHub (Jan 1, 2026):

I following your bot guide but still not work. Refuse to connect from the embedded AI bot to the website. that strange

@tnfsmith commented on GitHub (Jan 1, 2026): I following your bot guide but still not work. Refuse to connect from the embedded AI bot to the website. that strange
yindo commented 2026-02-21 20:12:24 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Jan 1, 2026):

If embedding still refuses to connect after following the bot guide, here are the most common causes and next steps:

  1. Make sure you set NEXT_PUBLIC_ALLOW_EMBED=true in your frontend (web/.env), then fully rebuild and restart the frontend service. This is the only way to remove the restrictive X-Frame-Options header and allow embedding on external sites—backend .env settings like ALLOW_EMBED do not affect this behavior. Reference

  2. Double-check your embed code uses the correct domain (not localhost or 127.0.0.1) and uses HTTPS, as HTTP can cause the embedded app not to display in some browsers. Reference

  3. If you use a reverse proxy (Nginx, Traefik), make sure buffering is disabled and HTTP/1.1 is enforced for streaming endpoints. For Nginx, use:

    proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_cache off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;

    Most streaming and connection issues are caused by buffering at the proxy layer, not by Dify itself. Reference

  4. If you have a Content-Security-Policy (CSP) set via NEXT_PUBLIC_CSP_WHITELIST, make sure all domains serving embedded content are whitelisted, or embedding and resource loading may still fail.

If you’ve done all of the above and it still fails, please share (with sensitive info redacted): your frontend .env, backend .env, docker-compose.yaml, and any reverse proxy config. Also, a screenshot or copy of the browser’s network tab showing the failed request and response headers will help pinpoint the issue.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Jan 1, 2026): <!-- Answer --> If embedding still refuses to connect after following the bot guide, here are the most common causes and next steps: 1. Make sure you set NEXT_PUBLIC_ALLOW_EMBED=true in your frontend (web/.env), then fully rebuild and restart the frontend service. This is the only way to remove the restrictive X-Frame-Options header and allow embedding on external sites—backend .env settings like ALLOW_EMBED do not affect this behavior. [Reference](https://github.com/langgenius/dify/blob/9b6b2f31950c50ec54a06985dadaf6577e295c83/web/middleware.ts#L6-L64) 2. Double-check your embed code uses the correct domain (not localhost or 127.0.0.1) and uses HTTPS, as HTTP can cause the embedded app not to display in some browsers. [Reference](https://github.com/langgenius/dify/issues/13501) 3. If you use a reverse proxy (Nginx, Traefik), make sure buffering is disabled and HTTP/1.1 is enforced for streaming endpoints. For Nginx, use: ``` proxy_http_version 1.1; proxy_set_header Connection ""; proxy_buffering off; proxy_cache off; proxy_read_timeout 3600s; proxy_send_timeout 3600s; ``` Most streaming and connection issues are caused by buffering at the proxy layer, not by Dify itself. [Reference](https://github.com/langgenius/dify/discussions/25399#discussioncomment-14347211) 4. If you have a Content-Security-Policy (CSP) set via NEXT_PUBLIC_CSP_WHITELIST, make sure all domains serving embedded content are whitelisted, or embedding and resource loading may still fail. If you’ve done all of the above and it still fails, please share (with sensitive info redacted): your frontend .env, backend .env, docker-compose.yaml, and any reverse proxy config. Also, a screenshot or copy of the browser’s network tab showing the failed request and response headers will help pinpoint the issue. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/74741876-8357-4495-809d-23f8474862bb?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/74741876-8357-4495-809d-23f8474862bb?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/74741876-8357-4495-809d-23f8474862bb?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/74741876-8357-4495-809d-23f8474862bb?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/74741876-8357-4495-809d-23f8474862bb?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/74741876-8357-4495-809d-23f8474862bb?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/74741876-8357-4495-809d-23f8474862bb?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=If%20embedding%20still%20refuses%20to%20connect%20after%20following%20the%20bot%20guide%2C%20here%20are%20the%20most%20common%20causes%20and%20next%20steps%3A%0A%0A1.%20Make%20sure%20you%20set%20NEXT_PUBLIC_ALLOW_EMBED%3Dtrue%20in%20your%20frontend%20%28web/.env%29%2C%20then%20fully%20rebuild%20and%20restart%20the%20frontend%20service.%20This%20is%20the%20only%20way%20to%20remove%20the%20restrictive%20X-Frame-Options%20header%20and%20allow%20embedding%20on%20external%20sites%E2%80%94backend%20.env%20settings%20like%20ALLOW_EMBED%20do%20not%20affect%20this%20behavior.%20%5BReference%5D%28https%3A//github.com/langgenius/dify/blob/9b6b2f31950c50ec54a06985dadaf6577e295c83/web/middleware.ts%23L6-L64%29%0A%0A2.%20Double-check%20your%20embed%20code%20uses%20the%20correct%20domain%20%28not%20localhost%20or%20127.0.0.1%29%20and%20uses%20HTTPS%2C%20as%20HTTP%20can%20cause%20the%20embedded%20app%20not%20to%20display%20in%20some%20browsers.%20%5BReference%5D%28https%3A//github.com/langgenius/dify/issues/13501%29%0A%0A3.%20If%20you%20use%20a%20reverse%20proxy%20%28Nginx%2C%20Traefik%29%2C%20make%20sure%20buffering%20is%20disabled%20and%20HTTP/1.1%20is%20enforced%20for%20streaming%20endpoints.%20For%20Nginx%2C%20use%3A%0A%20%20%20%60%60%60%0A%20%20%20proxy_http_version%201.1%3B%0A%20%20%20proxy_set_header%20Connection%20%22%22%3B%0A%20%20%20proxy_buffering%20off%3B%0A%20%20%20proxy_cache%20off%3B%0A%20%20%20proxy_read_timeout%203600s%3B%0A%20%20%20proxy_send_timeout%203600s%3B%0A%20%20%20%60%60%60%0A%20%20%20Most%20streaming%20and%20connection%20issues%20are%20caused%20by%20buffering%20at%20the%20proxy%20layer%2C%20not%20by%20Dify%20itself.%20%5BReference%5D%28https%3A//github.com/langgenius/dify/discussions/25399%23discussioncomment-14347211%29%0A%0A4.%20If%20you%20have%20a%20Content-Security-Policy%20%28CSP%29%20set%20via%20NEXT_PUBLIC_CSP_WHITELIST%2C%20make%20sure%20all%20domains%20serving%20embedded%20content%20are%20whitelisted%2C%20or%20embedding%20and%20resource%20loading%20may%20still%20fail.%0A%0AIf%20you%E2%80%99ve%20done%20all%20of%20the%20above%20and%20it%20still%20fails%2C%20please%20share%20%28with%20sensitive%20info%20redacted%29%3A%20your%20frontend%20.env%2C%20backend%20.env%2C%20docker-compose.yaml%2C%20and%20any%20reverse%20proxy%20config.%20Also%2C%20a%20screenshot%20or%20copy%20of%20the%20browser%E2%80%99s%20network%20tab%20showing%20the%20failed%20request%20and%20response%20headers%20will%20help%20pinpoint%20the%20issue.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/30440)
yindo commented 2026-02-21 20:12:24 -05:00
Author
Owner
Copy Link
Copy Source

@tnfsmith commented on GitHub (Jan 1, 2026):

Repeat, you don't try to guest anything here. I do all these steps and failed all. So I open and report issues here. Understand me stupid bot?

@tnfsmith commented on GitHub (Jan 1, 2026): Repeat, you don't try to guest anything here. I do all these steps and failed all. So I open and report issues here. Understand me stupid bot?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#21399
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?