langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-08-27 21:10:04 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

dify configure frp and access abnormality after intranet penetration #5553

New Issue
Closed
opened 2026-02-21 18:11:35 -05:00 by yindo · 5 comments
yindo commented 2026-02-21 18:11:35 -05:00
Owner
Copy Link
Copy Source

Originally created by @lizhanyang505 on GitHub (Sep 11, 2024).

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

0.8.0

Cloud or Self Hosted

Self Hosted (Source)

Steps to reproduce

Access to the internal network is normal, but the external network penetration report fails to pre-check.
proxies
name = "dify" # 应用名，自定义
type = "tcp" # 连接方式：有http,https,UDP等
localIP = "192.168.12.76" # 本地连接地址
localPort = 3000 # 本地端口
remotePort = 3005
image
image
image

✔️ Expected Behavior

No response

❌ Actual Behavior

No response

Originally created by @lizhanyang505 on GitHub (Sep 11, 2024). ### Self Checks - [X] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [X] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [X] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [X] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:） - [X] Please do not modify this template :) and fill in all the required fields. ### Dify version 0.8.0 ### Cloud or Self Hosted Self Hosted (Source) ### Steps to reproduce Access to the internal network is normal, but the external network penetration report fails to pre-check. [[proxies]] name = "dify" # 应用名，自定义 type = "tcp" # 连接方式：有http,https,UDP等 localIP = "192.168.12.76" # 本地连接地址 localPort = 3000 # 本地端口 remotePort = 3005 ![image](https://github.com/user-attachments/assets/2813c12c-547a-4efe-be64-c1d6324be6b4) ![image](https://github.com/user-attachments/assets/c3a8dee8-6811-42cc-8526-ee555d5c6d07) ![image](https://github.com/user-attachments/assets/7f3c048d-46ba-4f8b-ad17-3c052a2dd8ab) ### ✔️ Expected Behavior _No response_ ### ❌ Actual Behavior _No response_
yindo added the 🐞 bug label 2026-02-21 18:11:35 -05:00
yindo closed this issue 2026-02-21 18:11:35 -05:00
yindo commented 2026-02-21 18:11:35 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Sep 11, 2024):

To address the issue of CORS errors when accessing Dify through FRP (Fast Reverse Proxy) after intranet penetration, you can follow these steps:

  1. Check CORS Configuration:
    Ensure that the CORS settings in your Dify configuration allow access from the required external domains. The default CORS settings in Dify are as follows:

    • CONSOLE_CORS_ALLOW_ORIGINS: Default is *, allowing access from all domains.
    • WEB_API_CORS_ALLOW_ORIGINS: Default is *, allowing access from all domains.

    You can modify these settings by setting the environment variables CONSOLE_CORS_ALLOW_ORIGINS and WEB_API_CORS_ALLOW_ORIGINS to the specific domains you want to allow. For example:

    export CONSOLE_CORS_ALLOW_ORIGINS="https://example.com"
export WEB_API_CORS_ALLOW_ORIGINS="https://example.com"

    This will restrict access to only the specified domain (https://example.com). Additionally, if you want to enable cross-origin support for CSRF cookies, you must use the HTTPS protocol and set the configuration to SameSite=None, Secure=true, HttpOnly=true [1][2].

  2. Update Domain/URL Configuration:
    Ensure that the domain name/URL has not been switched, which can cause cross-domain issues between the front end and the back end. Update all relevant configuration items in docker-compose.yml to the new domain name:

    services:
  api:
    environment:
      - CONSOLE_API_URL=https://new-domain.com/api
      - SERVICE_API_URL=https://new-domain.com/service
      - APP_API_URL=https://new-domain.com/app-api
  web:
    environment:
      - CONSOLE_WEB_URL=https://new-domain.com
      - APP_WEB_URL=https://new-domain.com/app

  3. Check FRP Configuration:
    Ensure that your FRP configuration is correctly set up to forward the necessary ports and IP addresses. Your provided configuration looks correct, but double-check the local and remote ports:

    [[proxies]]
name = "dify"
type = "tcp"
localIP = "192.168.12.76"
localPort = 3000
remotePort = 3005

  4. Troubleshoot CORS Errors:
    If you continue to experience CORS errors, refer to the common troubleshooting steps for resolving CORS errors in a Dify self-hosted setup:

    • Ensure that the CORS configuration allows access from the required domains.
    • Verify that the domain/URL configurations are consistent and correctly set.
    • Check for any persistent loading and CORS errors in the requests, which may indicate domain/URL changes [3][4].

By following these steps, you should be able to resolve the CORS errors and access Dify through FRP without issues.

To continue talking to Dosu, mention @dosu.

@dosubot[bot] commented on GitHub (Sep 11, 2024): <!-- Answer --> To address the issue of CORS errors when accessing Dify through FRP (Fast Reverse Proxy) after intranet penetration, you can follow these steps: 1. **Check CORS Configuration**: Ensure that the CORS settings in your Dify configuration allow access from the required external domains. The default CORS settings in Dify are as follows: - `CONSOLE_CORS_ALLOW_ORIGINS`: Default is `*`, allowing access from all domains. - `WEB_API_CORS_ALLOW_ORIGINS`: Default is `*`, allowing access from all domains. You can modify these settings by setting the environment variables `CONSOLE_CORS_ALLOW_ORIGINS` and `WEB_API_CORS_ALLOW_ORIGINS` to the specific domains you want to allow. For example: ```bash export CONSOLE_CORS_ALLOW_ORIGINS="https://example.com" export WEB_API_CORS_ALLOW_ORIGINS="https://example.com" ``` This will restrict access to only the specified domain (`https://example.com`). Additionally, if you want to enable cross-origin support for CSRF cookies, you must use the HTTPS protocol and set the configuration to `SameSite=None, Secure=true, HttpOnly=true` <sup>[[1]](https://github.com/langgenius/dify-docs/blob/main/jp/getting-started/install-self-hosted/environments.md)</sup><sup>[[2]](https://github.com/langgenius/dify/blob/main/api/.env.example)</sup>. 2. **Update Domain/URL Configuration**: Ensure that the domain name/URL has not been switched, which can cause cross-domain issues between the front end and the back end. Update all relevant configuration items in `docker-compose.yml` to the new domain name: ```yaml services: api: environment: - CONSOLE_API_URL=https://new-domain.com/api - SERVICE_API_URL=https://new-domain.com/service - APP_API_URL=https://new-domain.com/app-api web: environment: - CONSOLE_WEB_URL=https://new-domain.com - APP_WEB_URL=https://new-domain.com/app ``` 3. **Check FRP Configuration**: Ensure that your FRP configuration is correctly set up to forward the necessary ports and IP addresses. Your provided configuration looks correct, but double-check the local and remote ports: ```toml [[proxies]] name = "dify" type = "tcp" localIP = "192.168.12.76" localPort = 3000 remotePort = 3005 ``` 4. **Troubleshoot CORS Errors**: If you continue to experience CORS errors, refer to the common troubleshooting steps for resolving CORS errors in a Dify self-hosted setup: - Ensure that the CORS configuration allows access from the required domains. - Verify that the domain/URL configurations are consistent and correctly set. - Check for any persistent loading and CORS errors in the requests, which may indicate domain/URL changes <sup>[[3]](https://github.com/langgenius/dify-docs/blob/main/en/getting-started/install-self-hosted/install-faq.md)</sup><sup>[[4]](https://github.com/langgenius/dify-docs/blob/main/en/learn-more/faq/install-faq.md)</sup>. By following these steps, you should be able to resolve the CORS errors and access Dify through FRP without issues. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
yindo commented 2026-02-21 18:11:35 -05:00
Author
Owner
Copy Link
Copy Source

@lizhanyang505 commented on GitHub (Sep 11, 2024):

If my local IP is 192.168.12.76, how can I configure the information to solve the problem of cors without using nginx?

@lizhanyang505 commented on GitHub (Sep 11, 2024): If my local IP is 192.168.12.76, how can I configure the information to solve the problem of cors without using nginx?
yindo commented 2026-02-21 18:11:35 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Sep 11, 2024):

To solve the problem of CORS without using Nginx, you can configure the CORS settings directly in your Flask application. Set the following environment variables to allow cross-origin requests from your local IP 192.168.12.76:

export CONSOLE_CORS_ALLOW_ORIGINS="http://192.168.12.76"
export WEB_API_CORS_ALLOW_ORIGINS="http://192.168.12.76"

Additionally, ensure that other relevant environment variables such as CONSOLE_WEB_URL and APP_WEB_URL are correctly set to reflect your local setup:

export CONSOLE_WEB_URL="http://192.168.12.76:3000"
export APP_WEB_URL="http://192.168.12.76:3000"

In your Flask application, use the flask_cors library to apply these settings. Here is an example of how you can configure CORS in your create_app function:

from flask import Flask
from flask_cors import CORS

def create_app() -> Flask:
    app = Flask(__name__)
    app.config.from_mapping(dify_config.model_dump())

    # Apply CORS settings
    CORS(
        app,
        resources={
            r"/api/*": {"origins": app.config["WEB_API_CORS_ALLOW_ORIGINS"]},
            r"/console/*": {"origins": app.config["CONSOLE_CORS_ALLOW_ORIGINS"]}
        },
        supports_credentials=True,
        allow_headers=["Content-Type", "Authorization", "X-App-Code"],
        methods=["GET", "PUT", "POST", "DELETE", "OPTIONS", "PATCH"],
        expose_headers=["X-Version", "X-Env"]
    )

    # Other app initialization code...
    initialize_extensions(app)
    register_blueprints(app)
    register_commands(app)

    return app

This ensures that the URLs used by your application are consistent with your local IP setup and that CORS is properly configured to allow requests from your specified origins [1][2][3][4].

To continue talking to Dosu, mention @dosu.

@dosubot[bot] commented on GitHub (Sep 11, 2024): <!-- Answer --> To solve the problem of CORS without using Nginx, you can configure the CORS settings directly in your Flask application. Set the following environment variables to allow cross-origin requests from your local IP `192.168.12.76`: ```bash export CONSOLE_CORS_ALLOW_ORIGINS="http://192.168.12.76" export WEB_API_CORS_ALLOW_ORIGINS="http://192.168.12.76" ``` Additionally, ensure that other relevant environment variables such as `CONSOLE_WEB_URL` and `APP_WEB_URL` are correctly set to reflect your local setup: ```bash export CONSOLE_WEB_URL="http://192.168.12.76:3000" export APP_WEB_URL="http://192.168.12.76:3000" ``` In your Flask application, use the `flask_cors` library to apply these settings. Here is an example of how you can configure CORS in your `create_app` function: ```python from flask import Flask from flask_cors import CORS def create_app() -> Flask: app = Flask(__name__) app.config.from_mapping(dify_config.model_dump()) # Apply CORS settings CORS( app, resources={ r"/api/*": {"origins": app.config["WEB_API_CORS_ALLOW_ORIGINS"]}, r"/console/*": {"origins": app.config["CONSOLE_CORS_ALLOW_ORIGINS"]} }, supports_credentials=True, allow_headers=["Content-Type", "Authorization", "X-App-Code"], methods=["GET", "PUT", "POST", "DELETE", "OPTIONS", "PATCH"], expose_headers=["X-Version", "X-Env"] ) # Other app initialization code... initialize_extensions(app) register_blueprints(app) register_commands(app) return app ``` This ensures that the URLs used by your application are consistent with your local IP setup and that CORS is properly configured to allow requests from your specified origins <sup>[[1]](https://github.com/langgenius/dify-docs/blob/main/jp/getting-started/install-self-hosted/environments.md)</sup><sup>[[2]](https://github.com/langgenius/dify-docs/blob/main/en/getting-started/install-self-hosted/environments.md)</sup><sup>[[3]](https://github.com/langgenius/dify/blob/main/api/.env.example)</sup><sup>[[4]](https://github.com/langgenius/dify/blob/main/api/app.py)</sup>. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
yindo commented 2026-02-21 18:11:35 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Sep 11, 2024):

If my local IP is 192.168.12.76, how can I configure the information to solve the problem of cors without using nginx?

If you need to access from a public address, the env settings should be that as well.

@crazywoola commented on GitHub (Sep 11, 2024): > If my local IP is 192.168.12.76, how can I configure the information to solve the problem of cors without using nginx? If you need to access from a public address, the env settings should be that as well.
yindo commented 2026-02-21 18:11:35 -05:00
Author
Owner
Copy Link
Copy Source

@lizhanyang505 commented on GitHub (Sep 11, 2024):

@crazywoola I followed the above operation, but the result failed. Could you please provide a link or explanation to the complete operation document? Thanks~。

@lizhanyang505 commented on GitHub (Sep 11, 2024): @crazywoola I followed the above operation, but the result failed. Could you please provide a link or explanation to the complete operation document? Thanks~。
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#5553
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?