langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 20:15:31 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

The HTTP component of the workflow reports a 403 error when calling the remote service API. #8252

New Issue
Closed
opened 2026-02-21 18:24:42 -05:00 by yindo · 2 comments
yindo commented 2026-02-21 18:24:42 -05:00
Owner
Copy Link
Copy Source

Originally created by @layoonmietly on GitHub (Feb 13, 2025).

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

lasted

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

  1. Deploying with Docker
  2. Create an application and select WorkFlow
  3. Configure 3 nodes: Start, HTTP Request, End
  4. Configure HTTP request, fill in the URL of the remote service API for GET request, configure the header, no authentication
  5. Publish and run, execute to HTTP node report 403
  6. Enter the docker-ssrf_proxy container, view the logs, and it will display: "172.18.0.8 TCP_DENIED/403 3792 CONNECT xxxxxx.com - HIER_NONE/- text/html"
  7. Add header to HTTP node to configure ContentType: After running application/json, it still reports a 403 error
  8. Use the curl command: curl -H "xxxx:xxx" https://xxxx.xxx.com/api/getUser Can obtain the correct JSON data response
  9. Attempt to make a direct request using the HTTP request component https://www.google.cn/ Can access the website correctly
  10. The POST request attempting to access another remote service using an HTTP request also reports 403, and the log of docker-ssrf_proxy also shows "172.18.0.8 TCP-DINIED/403 3792 CONNECT xxxxxx.com - HIERNONE/- text/html"

✔️ Expected Behavior

The HTTP request component can be used

❌ Actual Behavior

No response

Originally created by @layoonmietly on GitHub (Feb 13, 2025). ### Self Checks - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [x] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version lasted ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce 1. Deploying with Docker 2. Create an application and select WorkFlow 3. Configure 3 nodes: Start, HTTP Request, End 4. Configure HTTP request, fill in the URL of the remote service API for GET request, configure the header, no authentication 5. Publish and run, execute to HTTP node report 403 6. Enter the docker-ssrf_proxy container, view the logs, and it will display: "172.18.0.8 TCP_DENIED/403 3792 CONNECT xxxxxx.com - HIER_NONE/- text/html" 7. Add header to HTTP node to configure ContentType: After running application/json, it still reports a 403 error 8. Use the curl command: curl -H "xxxx:xxx" https://xxxx.xxx.com/api/getUser Can obtain the correct JSON data response 9. Attempt to make a direct request using the HTTP request component https://www.google.cn/ Can access the website correctly 10. The POST request attempting to access another remote service using an HTTP request also reports 403, and the log of docker-ssrf_proxy also shows "172.18.0.8 TCP-DINIED/403 3792 CONNECT xxxxxx.com - HIERNONE/- text/html" ### ✔️ Expected Behavior The HTTP request component can be used ### ❌ Actual Behavior _No response_
yindo added the 🐞 bug🌊 feat:workflow labels 2026-02-21 18:24:42 -05:00
yindo closed this issue 2026-02-21 18:24:43 -05:00
yindo commented 2026-02-21 18:24:43 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Feb 13, 2025):

I found some similar threads that might be relevant to your issue:

  1. Unable to use external HTTP requests after installing Dify with docker-compose on Ubuntu - This discussion is still open and might provide insights into your problem.
  2. 403 Forbidden - Another open discussion that deals with 403 errors, which could be related to your issue.

For resolving the 403 error, you might want to check the following configurations in your squid.conf file, as they could be affecting HTTP request handling:

  • Safe Ports Configuration: Ensure that the port you are trying to access is listed in the Safe_ports ACL. If not, it will result in a 403 error.
  • CONNECT Method Configuration: Make sure the CONNECT method is allowed for the ports you are using. If not, it will also result in a 403 error.
  • General Access Control: Verify that your requests are allowed by the access control rules. If they don't match any allowed rules, they will be denied [1].

Additionally, ensure that your domain is correctly listed in the squid.conf file and that the ssrf_proxy is properly configured to handle your requests. You can also perform curl tests from inside the Docker container to verify connectivity [2][3].

To continue talking to Dosu, mention @dosu.

Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Other | Bug Report

@dosubot[bot] commented on GitHub (Feb 13, 2025): <!-- Answer --> I found some similar threads that might be relevant to your issue: 1. [Unable to use external HTTP requests after installing Dify with docker-compose on Ubuntu](https://github.com/langgenius/dify/discussions/8423) - This discussion is still open and might provide insights into your problem. 2. [403 Forbidden](https://github.com/langgenius/dify/discussions/6970) - Another open discussion that deals with 403 errors, which could be related to your issue. For resolving the 403 error, you might want to check the following configurations in your `squid.conf` file, as they could be affecting HTTP request handling: - **Safe Ports Configuration**: Ensure that the port you are trying to access is listed in the `Safe_ports` ACL. If not, it will result in a 403 error. - **CONNECT Method Configuration**: Make sure the `CONNECT` method is allowed for the ports you are using. If not, it will also result in a 403 error. - **General Access Control**: Verify that your requests are allowed by the access control rules. If they don't match any allowed rules, they will be denied <sup>[[1]](https://github.com/langgenius/dify/blob/main/docker-legacy/volumes/ssrf_proxy/squid.conf)</sup>. Additionally, ensure that your domain is correctly listed in the `squid.conf` file and that the `ssrf_proxy` is properly configured to handle your requests. You can also perform `curl` tests from inside the Docker container to verify connectivity <sup>[[2]](https://github.com/langgenius/dify/discussions/8423)</sup><sup>[[3]](https://github.com/langgenius/dify/discussions/6970)</sup>. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.* --- <sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/0e8379eb-c902-44bc-864e-519f452b03fa?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/0e8379eb-c902-44bc-864e-519f452b03fa?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/0e8379eb-c902-44bc-864e-519f452b03fa?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/0e8379eb-c902-44bc-864e-519f452b03fa?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/0e8379eb-c902-44bc-864e-519f452b03fa?feedback_type=hallucination) | [Other](https://app.dosu.dev/response-feedback/0e8379eb-c902-44bc-864e-519f452b03fa?feedback_type=other) | [Bug Report](https://app.dosu.dev/response-feedback/0e8379eb-c902-44bc-864e-519f452b03fa?feedback_type=bug_report)</sup>
yindo commented 2026-02-21 18:24:43 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Feb 13, 2025):

Check out the article https://docs.dify.ai/learn-more/faq/install-faq#id-18.-why-is-ssrf_proxy-needed.

We use SSRF_PROXY to avoid potential attacks. If you want to access the services please add the url to the configuration file https://github.com/langgenius/dify/blob/6622c7f98d835c79e1f9d908d378a2ec2c3ceabf/docker/ssrf_proxy/squid.conf.template

@crazywoola commented on GitHub (Feb 13, 2025): Check out the article https://docs.dify.ai/learn-more/faq/install-faq#id-18.-why-is-ssrf_proxy-needed. We use SSRF_PROXY to avoid potential attacks. If you want to access the services please add the url to the configuration file https://github.com/langgenius/dify/blob/6622c7f98d835c79e1f9d908d378a2ec2c3ceabf/docker/ssrf_proxy/squid.conf.template
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🌊 feat:workflow 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#8252
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?