[PR #32287] fix: copy to clipboard failed in non-secure (HTTP) contexts #33651

Open
opened 2026-02-21 20:53:40 -05:00 by yindo · 0 comments
Owner

Original Pull Request: https://github.com/langgenius/dify/pull/32287

State: open
Merged: No


Problem

The copy button (e.g., for API secret keys) becomes non-functional when Dify is accessed over an insecure HTTP connection (common in local network or private cloud deployments). This is due to navigator.clipboard being restricted to Secure Contexts.

This issue was reported in #32172 and observed in environments like Kylin Linux.

Solution

Added a robust fallback mechanism using a temporary textarea and document.execCommand('copy') when the primary copy library returns false.

  • Invisible Implementation: The temporary textarea is positioned off-screen (-9999px) to ensure no UI flickering or layout shift occurs during the operation.
  • Improved Compatibility: Ensures the copy function works across all deployment environments (HTTP/HTTPS) and specialized browsers.

Checklist

  • Verified the fallback logic works in non-HTTPS environments.
  • Confirmed no impact on existing HTTPS/localhost functionality.
  • Minimized code changes to avoid side effects.

Fixes #32172

**Original Pull Request:** https://github.com/langgenius/dify/pull/32287 **State:** open **Merged:** No --- ### Problem The copy button (e.g., for API secret keys) becomes non-functional when Dify is accessed over an insecure HTTP connection (common in local network or private cloud deployments). This is due to `navigator.clipboard` being restricted to Secure Contexts. This issue was reported in #32172 and observed in environments like Kylin Linux. ### Solution Added a robust fallback mechanism using a temporary `textarea` and `document.execCommand('copy')` when the primary copy library returns `false`. - **Invisible Implementation:** The temporary `textarea` is positioned off-screen (`-9999px`) to ensure no UI flickering or layout shift occurs during the operation. - **Improved Compatibility:** Ensures the copy function works across all deployment environments (HTTP/HTTPS) and specialized browsers. ### Checklist - [x] Verified the fallback logic works in non-HTTPS environments. - [x] Confirmed no impact on existing HTTPS/localhost functionality. - [x] Minimized code changes to avoid side effects. Fixes #32172
yindo added the pull-request label 2026-02-21 20:53:40 -05:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#33651