Hidden File Variable with Default Value Not Working in Conversation Interface & Question About File Path Exposure #22051

Open
opened 2026-02-21 20:15:33 -05:00 by yindo · 4 comments
Owner

Originally created by @zlove520 on GitHub (Feb 4, 2026).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交,否则会被关闭 :)
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.10.1->fix.1

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

Create a workflow and add an input node.
Bind a hidden file variable to the input node, and set a default file for this variable.
Debug the workflow in the edit interface: runs normally (default file is used).
Open the conversation interface and trigger the workflow: get "No file uploaded" error.
Check the /api/parameters API response: user_input_form contains the default file parameters of the hidden variable.

✔️ Expected Behavior

The hidden file variable with default value should be recognized in the conversation interface (no "No file uploaded" error).
Clarification on whether the default file path in user_input_form is exposed during runtime.

Actual Behavior

"No file uploaded" error in conversation interface (default file not loaded).
Uncertainty about file path exposure from user_input_form in /api/parameters response.

Originally created by @zlove520 on GitHub (Feb 4, 2026). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交,否则会被关闭 :) - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.10.1->fix.1 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce Create a workflow and add an input node. Bind a hidden file variable to the input node, and set a default file for this variable. Debug the workflow in the edit interface: runs normally (default file is used). Open the conversation interface and trigger the workflow: get "No file uploaded" error. Check the /api/parameters API response: user_input_form contains the default file parameters of the hidden variable. ### ✔️ Expected Behavior The hidden file variable with default value should be recognized in the conversation interface (no "No file uploaded" error). Clarification on whether the default file path in user_input_form is exposed during runtime. ### ❌ Actual Behavior "No file uploaded" error in conversation interface (default file not loaded). Uncertainty about file path exposure from user_input_form in /api/parameters response.
yindo added the 🐞 bug🙏 help wanted labels 2026-02-21 20:15:33 -05:00
Author
Owner

@zlove520 commented on GitHub (Feb 4, 2026):

Description
I encountered an issue when using a hidden file variable in the workflow input node, along with the following details:
Problem Scenario:
I bound a hidden file variable to a workflow input node and set a default file value for it.
Debugging in the workflow edit interface works perfectly (no errors, default file is recognized).
However, when opening the conversation interface and running the workflow, it throws an error prompting "No file uploaded" (even though the default file is configured).
Additional Observation:
I checked the response of the front-end API /api/parameters, and found the default file-related parameters in the user_input_form field of the returned data.
Key Question:
Since the default file parameters exist in user_input_form from the /api/parameters API response, I want to confirm:
Will the file path (or related access address) of this default file be exposed during the workflow runtime?
Why is the default file value not recognized in the conversation interface (but works in edit interface debugging)?

@zlove520 commented on GitHub (Feb 4, 2026): Description I encountered an issue when using a hidden file variable in the workflow input node, along with the following details: Problem Scenario: I bound a hidden file variable to a workflow input node and set a default file value for it. Debugging in the workflow edit interface works perfectly (no errors, default file is recognized). However, when opening the conversation interface and running the workflow, it throws an error prompting "No file uploaded" (even though the default file is configured). Additional Observation: I checked the response of the front-end API /api/parameters, and found the default file-related parameters in the user_input_form field of the returned data. Key Question: Since the default file parameters exist in user_input_form from the /api/parameters API response, I want to confirm: Will the file path (or related access address) of this default file be exposed during the workflow runtime? Why is the default file value not recognized in the conversation interface (but works in edit interface debugging)?
Author
Owner

@dosubot[bot] commented on GitHub (Feb 4, 2026):

The reason the default file value for your hidden file variable works in the workflow edit/debug interface but not in the conversation interface is that the debug interface loads the draft workflow (which includes your latest changes and default values), while the conversation interface uses the published workflow. If the published workflow doesn't have the default file properly set or accessible, the conversation interface won't recognize it, resulting in the "No file uploaded" error. Make sure your published workflow includes the correct default file configuration to align both interfaces source.

As for file path exposure: the /api/parameters endpoint includes the default file parameters in the user_input_form, but it does not expose raw storage paths. If a file URL is present, it will be a signed, temporary URL for security, not a direct or permanent path. This means the file's access address is not directly exposed to end-users during workflow runtime—only the structured metadata as defined in your workflow config is returned source.

To reply, just mention @dosu.


How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Feb 4, 2026): <!-- Answer --> The reason the default file value for your hidden file variable works in the workflow edit/debug interface but not in the conversation interface is that the debug interface loads the draft workflow (which includes your latest changes and default values), while the conversation interface uses the published workflow. If the published workflow doesn't have the default file properly set or accessible, the conversation interface won't recognize it, resulting in the "No file uploaded" error. Make sure your published workflow includes the correct default file configuration to align both interfaces [source](https://github.com/langgenius/dify/blob/778aabb4859199db7c9f0eafc690d6d3cb2745b6/api/services/app_generate_service.py#L27-L251). As for file path exposure: the /api/parameters endpoint includes the default file parameters in the user_input_form, but it does not expose raw storage paths. If a file URL is present, it will be a signed, temporary URL for security, not a direct or permanent path. This means the file's access address is not directly exposed to end-users during workflow runtime—only the structured metadata as defined in your workflow config is returned [source](https://github.com/langgenius/dify/blob/64e769f96ea01161ca8e28af7db2dbe590a5d048/api/controllers/service_api/app/app.py#L12-L48). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=The%20reason%20the%20default%20file%20value%20for%20your%20hidden%20file%20variable%20works%20in%20the%20workflow%20edit/debug%20interface%20but%20not%20in%20the%20conversation%20interface%20is%20that%20the%20debug%20interface%20loads%20the%20draft%20workflow%20%28which%20includes%20your%20latest%20changes%20and%20default%20values%29%2C%20while%20the%20conversation%20interface%20uses%20the%20published%20workflow.%20If%20the%20published%20workflow%20doesn%27t%20have%20the%20default%20file%20properly%20set%20or%20accessible%2C%20the%20conversation%20interface%20won%27t%20recognize%20it%2C%20resulting%20in%20the%20%22No%20file%20uploaded%22%20error.%20Make%20sure%20your%20published%20workflow%20includes%20the%20correct%20default%20file%20configuration%20to%20align%20both%20interfaces%20%5Bsource%5D%28https%3A//github.com/langgenius/dify/blob/778aabb4859199db7c9f0eafc690d6d3cb2745b6/api/services/app_generate_service.py%23L27-L251%29.%0A%0AAs%20for%20file%20path%20exposure%3A%20the%20/api/parameters%20endpoint%20includes%20the%20default%20file%20parameters%20in%20the%20user_input_form%2C%20but%20it%20does%20not%20expose%20raw%20storage%20paths.%20If%20a%20file%20URL%20is%20present%2C%20it%20will%20be%20a%20signed%2C%20temporary%20URL%20for%20security%2C%20not%20a%20direct%20or%20permanent%20path.%20This%20means%20the%20file%27s%20access%20address%20is%20not%20directly%20exposed%20to%20end-users%20during%20workflow%20runtime%E2%80%94only%20the%20structured%20metadata%20as%20defined%20in%20your%20workflow%20config%20is%20returned%20%5Bsource%5D%28https%3A//github.com/langgenius/dify/blob/64e769f96ea01161ca8e28af7db2dbe590a5d048/api/controllers/service_api/app/app.py%23L12-L48%29.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/31908)
Author
Owner

@zlove520 commented on GitHub (Feb 4, 2026):

The reason the default file value for your hidden file variable works in the workflow edit/debug interface but not in the conversation interface is that the debug interface loads the draft workflow (which includes your latest changes and default values), while the conversation interface uses the published workflow. If the published workflow doesn't have the default file properly set or accessible, the conversation interface won't recognize it, resulting in the "No file uploaded" error. Make sure your published workflow includes the correct default file configuration to align both interfaces source.

As for file path exposure: the /api/parameters endpoint includes the default file parameters in the user_input_form, but it does not expose raw storage paths. If a file URL is present, it will be a signed, temporary URL for security, not a direct or permanent path. This means the file's access address is not directly exposed to end-users during workflow runtime—only the structured metadata as defined in your workflow config is returned source.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

I click the "Publish Update" button every time, but the default file still cannot be used directly on the workflow session interface.

@zlove520 commented on GitHub (Feb 4, 2026): > The reason the default file value for your hidden file variable works in the workflow edit/debug interface but not in the conversation interface is that the debug interface loads the draft workflow (which includes your latest changes and default values), while the conversation interface uses the published workflow. If the published workflow doesn't have the default file properly set or accessible, the conversation interface won't recognize it, resulting in the "No file uploaded" error. Make sure your published workflow includes the correct default file configuration to align both interfaces [source](https://github.com/langgenius/dify/blob/778aabb4859199db7c9f0eafc690d6d3cb2745b6/api/services/app_generate_service.py#L27-L251). > > As for file path exposure: the /api/parameters endpoint includes the default file parameters in the user_input_form, but it does not expose raw storage paths. If a file URL is present, it will be a signed, temporary URL for security, not a direct or permanent path. This means the file's access address is not directly exposed to end-users during workflow runtime—only the structured metadata as defined in your workflow config is returned [source](https://github.com/langgenius/dify/blob/64e769f96ea01161ca8e28af7db2dbe590a5d048/api/controllers/service_api/app/app.py#L12-L48). > > _To reply, just mention [@dosu](https://go.dosu.dev/dosubot)._ > > How did I do? [Good](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/2de161d3-d3bc-422d-8b9d-c4e1714781e3?feedback_type=other) > > [![Chat with Dosu](https://camo.githubusercontent.com/7c571478962a6b8a5d47cac74b6824c75e4f6731bba52377e6007f9150462923/68747470733a2f2f646f73752e6465762f646f73752d636861742d62616467652e737667)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github) [![Open in Cursor](https://camo.githubusercontent.com/bdf7dbded65ee585887f47e5fd6fa099ea0933088b4b03d02e83b4def50154d4/68747470733a2f2f646f73752e6465762f646f73752d696e2d637572736f722e737667)](https://cursor.com/link/prompt?text=The%20reason%20the%20default%20file%20value%20for%20your%20hidden%20file%20variable%20works%20in%20the%20workflow%20edit/debug%20interface%20but%20not%20in%20the%20conversation%20interface%20is%20that%20the%20debug%20interface%20loads%20the%20draft%20workflow%20%28which%20includes%20your%20latest%20changes%20and%20default%20values%29%2C%20while%20the%20conversation%20interface%20uses%20the%20published%20workflow.%20If%20the%20published%20workflow%20doesn%27t%20have%20the%20default%20file%20properly%20set%20or%20accessible%2C%20the%20conversation%20interface%20won%27t%20recognize%20it%2C%20resulting%20in%20the%20%22No%20file%20uploaded%22%20error.%20Make%20sure%20your%20published%20workflow%20includes%20the%20correct%20default%20file%20configuration%20to%20align%20both%20interfaces%20%5Bsource%5D%28https%3A//github.com/langgenius/dify/blob/778aabb4859199db7c9f0eafc690d6d3cb2745b6/api/services/app_generate_service.py%23L27-L251%29.%0A%0AAs%20for%20file%20path%20exposure%3A%20the%20/api/parameters%20endpoint%20includes%20the%20default%20file%20parameters%20in%20the%20user_input_form%2C%20but%20it%20does%20not%20expose%20raw%20storage%20paths.%20If%20a%20file%20URL%20is%20present%2C%20it%20will%20be%20a%20signed%2C%20temporary%20URL%20for%20security%2C%20not%20a%20direct%20or%20permanent%20path.%20This%20means%20the%20file%27s%20access%20address%20is%20not%20directly%20exposed%20to%20end-users%20during%20workflow%20runtime%E2%80%94only%20the%20structured%20metadata%20as%20defined%20in%20your%20workflow%20config%20is%20returned%20%5Bsource%5D%28https%3A//github.com/langgenius/dify/blob/64e769f96ea01161ca8e28af7db2dbe590a5d048/api/controllers/service_api/app/app.py%23L12-L48%29.) [![Join Discord](https://camo.githubusercontent.com/7d2066700925db1e370d956834f9ea0e5bc92cecbe84963fbd2a363e45091b4e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6a6f696e2d3538363546323f6c6f676f3d646973636f7264266c6f676f436f6c6f723d7768697465266c6162656c3d)](https://go.dosu.dev/discord-bot) [![Share on X](https://camo.githubusercontent.com/a8bd7f3fcf3f5e3bd124eee9ae50ae2ac17b40971726665ac2121d48f9aee155/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f582d73686172652d626c61636b)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/31908) I click the "Publish Update" button every time, but the default file still cannot be used directly on the workflow session interface.
Author
Owner

@dosubot[bot] commented on GitHub (Feb 4, 2026):

This is a known issue in Dify v1.10.1->fix.1: even after clicking "Publish Update," default file values for hidden variables may not be properly included in the published workflow, so the conversation interface can't access them and shows "No file uploaded" source. This often happens due to a backend validation bug with file (especially Array[File]) parameters—publishing fails silently or skips the default, even though the draft/debug interface works.

Workarounds: avoid setting default values for Array[File] parameters when publishing, or clear the default before publishing. If you need to check if the default file is present in the published workflow, inspect the published workflow's user_input_form or conversation_variables (via the API or database). Also, check backend logs for validation errors during publishing—these can block the default from being saved, even if the UI says "published" source.

File paths in API responses are always signed, temporary URLs, not raw storage paths, so file access is not exposed to end-users source.

To reply, just mention @dosu.


How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Feb 4, 2026): <!-- Answer --> This is a known issue in Dify v1.10.1->fix.1: even after clicking "Publish Update," default file values for hidden variables may not be properly included in the published workflow, so the conversation interface can't access them and shows "No file uploaded" [source](https://github.com/langgenius/dify/issues/30546). This often happens due to a backend validation bug with file (especially Array[File]) parameters—publishing fails silently or skips the default, even though the draft/debug interface works. Workarounds: avoid setting default values for Array[File] parameters when publishing, or clear the default before publishing. If you need to check if the default file is present in the published workflow, inspect the published workflow's user_input_form or conversation_variables (via the API or database). Also, check backend logs for validation errors during publishing—these can block the default from being saved, even if the UI says "published" [source](https://github.com/langgenius/dify/issues/30546). File paths in API responses are always signed, temporary URLs, not raw storage paths, so file access is not exposed to end-users [source](https://github.com/langgenius/dify/blob/64e769f96ea01161ca8e28af7db2dbe590a5d048/api/controllers/service_api/app/app.py#L12-L48). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/19538ce2-823e-4f21-acd7-b5dbd0937d6d?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/19538ce2-823e-4f21-acd7-b5dbd0937d6d?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/19538ce2-823e-4f21-acd7-b5dbd0937d6d?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/19538ce2-823e-4f21-acd7-b5dbd0937d6d?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/19538ce2-823e-4f21-acd7-b5dbd0937d6d?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/19538ce2-823e-4f21-acd7-b5dbd0937d6d?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/19538ce2-823e-4f21-acd7-b5dbd0937d6d?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=This%20is%20a%20known%20issue%20in%20Dify%20v1.10.1-%3Efix.1%3A%20even%20after%20clicking%20%22Publish%20Update%2C%22%20default%20file%20values%20for%20hidden%20variables%20may%20not%20be%20properly%20included%20in%20the%20published%20workflow%2C%20so%20the%20conversation%20interface%20can%27t%20access%20them%20and%20shows%20%22No%20file%20uploaded%22%20%5Bsource%5D%28https%3A//github.com/langgenius/dify/issues/30546%29.%20This%20often%20happens%20due%20to%20a%20backend%20validation%20bug%20with%20file%20%28especially%20Array%5BFile%5D%29%20parameters%E2%80%94publishing%20fails%20silently%20or%20skips%20the%20default%2C%20even%20though%20the%20draft/debug%20interface%20works.%0A%0AWorkarounds%3A%20avoid%20setting%20default%20values%20for%20Array%5BFile%5D%20parameters%20when%20publishing%2C%20or%20clear%20the%20default%20before%20publishing.%20If%20you%20need%20to%20check%20if%20the%20default%20file%20is%20present%20in%20the%20published%20workflow%2C%20inspect%20the%20published%20workflow%27s%20user_input_form%20or%20conversation_variables%20%28via%20the%20API%20or%20database%29.%20Also%2C%20check%20backend%20logs%20for%20validation%20errors%20during%20publishing%E2%80%94these%20can%20block%20the%20default%20from%20being%20saved%2C%20even%20if%20the%20UI%20says%20%22published%22%20%5Bsource%5D%28https%3A//github.com/langgenius/dify/issues/30546%29.%0A%0AFile%20paths%20in%20API%20responses%20are%20always%20signed%2C%20temporary%20URLs%2C%20not%20raw%20storage%20paths%2C%20so%20file%20access%20is%20not%20exposed%20to%20end-users%20%5Bsource%5D%28https%3A//github.com/langgenius/dify/blob/64e769f96ea01161ca8e28af7db2dbe590a5d048/api/controllers/service_api/app/app.py%23L12-L48%29.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/31908)
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#22051