2f6400db89
* fix: enforce ownership check and pass user_id in workflow job creation - Add _assert_job_owner helper that raises 403 for non-owners (legacy jobs with user_id=None are allowed through) - Move ownership check before job type check in stop_workflow to avoid leaking job.type to non-owners - Pass user_id to create_job in both sync and background execution paths - Add user_id parameter to JobService.create_job signature * test: add ownership and legacy job coverage for workflow endpoints - Add TestWorkflowIDORProtection class with tests for 403 on cross-user access - Add test for stop_workflow with legacy user_id=None job (should not return 403) * fix: pass user_id to create_job in knowledge_bases ingestion endpoint Prevents IDOR vulnerability where ingestion jobs created without user_id would bypass ownership checks, matching the fix applied to workflow jobs. * refactor: move job ownership check to JobService layer Moves _assert_job_owner from workflow.py into JobService.assert_job_owner so any future job-consuming endpoint can reuse the check without duplicating logic. Both get_workflow_status and stop_workflow now delegate to the service. * test: fix mocks for assert_job_owner after service layer refactor MagicMock blocks attributes starting with 'assert' by default. Added explicit mock_service.assert_job_owner = MagicMock() to each test that mocks get_job_service so the ownership check is a no-op for tests not focused on IDOR behavior. * refactor: enforce job ownership at SQL level, remove assert_job_owner Move IDOR ownership check from application layer into the DB query. `get_job_by_job_id` now accepts an optional `user_id` and filters by `job_id AND (user_id = ? OR user_id IS NULL)`, so unauthorized access returns 404 instead of 403. Removes `JobService.assert_job_owner`. - Strengthen legacy-job test assertions (!=403 → ==200) - Add missing GET test for non-WORKFLOW job type → 404
Langflow is a powerful platform for building and deploying AI-powered agents and workflows. It provides developers with both a visual authoring experience and built-in API and MCP servers that turn every workflow into a tool that can be integrated into applications built on any framework or stack. Langflow comes with batteries included and supports all major LLMs, vector databases and a growing library of AI tools.
✨ Highlight features
- Visual builder interface to quickly get started and iterate.
- Source code access lets you customize any component using Python.
- Interactive playground to immediately test and refine your flows with step-by-step control.
- Multi-agent orchestration with conversation management and retrieval.
- Deploy as an API or export as JSON for Python apps.
- Deploy as an MCP server and turn your flows into tools for MCP clients.
- Observability with LangSmith, LangFuse and other integrations.
- Enterprise-ready security and scalability.
🖥️ Langflow Desktop
Langflow Desktop is the easiest way to get started with Langflow. All dependencies are included, so you don't need to manage Python environments or install packages manually. Available for Windows and macOS.
⚡️ Quickstart
Install locally (recommended)
Requires Python 3.10–3.13 and uv (recommended package manager).
Install
From a fresh directory, run:
uv pip install langflow -U
The latest Langflow package is installed. For more information, see Install and run the Langflow OSS Python package.
Run
To start Langflow, run:
uv run langflow run
Langflow starts at http://127.0.0.1:7860.
That's it! You're ready to build with Langflow! 🎉
📦 Other install options
Run from source
If you've cloned this repository and want to contribute, run this command from the repository root:
make run_cli
For more information, see DEVELOPMENT.md.
Docker
Start a Langflow container with default settings:
docker run -p 7860:7860 langflowai/langflow:latest
Langflow is available at http://localhost:7860/. For configuration options, see the Docker deployment guide.
🛡️ Security
For security information, see our Security Policy.
🚀 Deployment
Langflow is completely open source and you can deploy it to all major deployment clouds. To learn how to deploy Langflow, see our Langflow deployment guides.
⭐ Stay up-to-date
Star Langflow on GitHub to be instantly notified of new releases.
👋 Contribute
We welcome contributions from developers of all levels. If you'd like to contribute, please check our contributing guidelines and help make Langflow more accessible.