mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-24 05:39:16 +08:00
* fix: add SSRF protection to URL component (PVR0699081) Add Server-Side Request Forgery (SSRF) protection to the URL component by integrating the existing validate_url_for_ssrf function. This prevents the component from being used to access internal resources like localhost, private IP ranges, and cloud metadata endpoints. The fix uses warn_only=True for backwards compatibility, matching the behavior of the API Request component. Full blocking will be enabled in the next major version (2.0). * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix: enforce SSRF blocking and add env variables to .env.example - Change warn_only=False to actually block internal URLs when SSRF protection is enabled - Add LANGFLOW_SSRF_PROTECTION_ENABLED and LANGFLOW_SSRF_ALLOWED_HOSTS to .env.example - Update tests to reflect blocking mode When LANGFLOW_SSRF_PROTECTION_ENABLED=true, requests to private IPs, localhost, and cloud metadata endpoints will be blocked. * fix: correct .env.example to show empty default for SSRF protection The default is false, so .env.example should be empty (not true). * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix: add SSRF protection to URL component (PVR0699081) Add Server-Side Request Forgery (SSRF) protection to the URL component by integrating the existing validate_url_for_ssrf function. This prevents the component from being used to access internal resources like localhost, private IP ranges, and cloud metadata endpoints. The fix uses warn_only=True for backwards compatibility, matching the behavior of the API Request component. Full blocking will be enabled in the next major version (2.0). * fix: enforce SSRF blocking and add env variables to .env.example - Change warn_only=False to actually block internal URLs when SSRF protection is enabled - Add LANGFLOW_SSRF_PROTECTION_ENABLED and LANGFLOW_SSRF_ALLOWED_HOSTS to .env.example - Update tests to reflect blocking mode When LANGFLOW_SSRF_PROTECTION_ENABLED=true, requests to private IPs, localhost, and cloud metadata endpoints will be blocked. * fix: correct .env.example to show empty default for SSRF protection The default is false, so .env.example should be empty (not true). * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
172 lines
5.3 KiB
Plaintext
172 lines
5.3 KiB
Plaintext
# Description: Example of .env file
|
||
# Usage: Copy this file to .env and change the values
|
||
# according to your needs
|
||
# Do not commit .env file to git
|
||
# Do not change .env.example file
|
||
|
||
# Config directory
|
||
# Directory where files, logs and database will be stored
|
||
# Example: LANGFLOW_CONFIG_DIR=~/.langflow
|
||
LANGFLOW_CONFIG_DIR=
|
||
|
||
# Save database in the config directory
|
||
# Values: true, false
|
||
# If false, the database will be saved in Langflow's root directory
|
||
# This means that the database will be deleted when Langflow is uninstalled
|
||
# and that the database will not be shared between different virtual environments
|
||
# Example: LANGFLOW_SAVE_DB_IN_CONFIG_DIR=true
|
||
LANGFLOW_SAVE_DB_IN_CONFIG_DIR=
|
||
|
||
# Database URL
|
||
# Postgres example: LANGFLOW_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/langflow
|
||
# SQLite example:
|
||
LANGFLOW_DATABASE_URL=sqlite:///./langflow.db
|
||
|
||
# Alembic logs path flag. If set to true, Alembic will log to stdout.
|
||
LANGFLOW_ALEMBIC_LOG_TO_STDOUT=False
|
||
|
||
|
||
# mem0 creates a directory
|
||
# for chat history, vector stores, and other artifacts
|
||
# its default path is ~/.mem0.
|
||
# we can change this path with
|
||
# environment variable "MEM0_DIR"
|
||
# Example: MEM0_DIR=/tmp/.mem0
|
||
|
||
# composio creates a cache directory
|
||
# for file uploads/downloads.
|
||
# its default path is ~/.composio
|
||
# we can change this path with
|
||
# environment variable "COMPOSIO_CACHE_DIR"
|
||
# Example: COMPOSIO_CACHE_DIR=/tmp/.composio
|
||
|
||
|
||
# Database connection retry
|
||
# Values: true, false
|
||
# If true, the database will retry to connect to the database if it fails
|
||
# Example: LANGFLOW_DATABASE_CONNECTION_RETRY=true
|
||
LANGFLOW_DATABASE_CONNECTION_RETRY=false
|
||
|
||
# Cache type
|
||
LANGFLOW_LANGCHAIN_CACHE=SQLiteCache
|
||
|
||
# Server host
|
||
# Example: LANGFLOW_HOST=localhost
|
||
LANGFLOW_HOST=
|
||
|
||
# Worker processes
|
||
# Example: LANGFLOW_WORKERS=1
|
||
LANGFLOW_WORKERS=
|
||
|
||
# Server port
|
||
# Example: LANGFLOW_PORT=7860
|
||
LANGFLOW_PORT=
|
||
|
||
# Logging level
|
||
# Example: LANGFLOW_LOG_LEVEL=critical
|
||
LANGFLOW_LOG_LEVEL=
|
||
|
||
# Path to the log file
|
||
# Example: LANGFLOW_LOG_FILE=logs/langflow.log
|
||
LANGFLOW_LOG_FILE=
|
||
|
||
# Time/Size for log to rotate
|
||
# Example: LANGFLOW_LOG_ROTATION=‘10 MB’/‘1 day’
|
||
LANGFLOW_LOG_ROTATION=
|
||
|
||
# Path to the frontend directory containing build files
|
||
# Example: LANGFLOW_FRONTEND_PATH=/path/to/frontend/build/files
|
||
LANGFLOW_FRONTEND_PATH=
|
||
|
||
# Whether to open the browser after starting the server
|
||
# Values: true, false
|
||
# Example: LANGFLOW_OPEN_BROWSER=true
|
||
LANGFLOW_OPEN_BROWSER=
|
||
|
||
# Whether to remove API keys from the projects saved in the database
|
||
# Values: true, false
|
||
# Example: LANGFLOW_REMOVE_API_KEYS=false
|
||
LANGFLOW_REMOVE_API_KEYS=
|
||
|
||
# Whether to use RedisCache or ThreadingInMemoryCache or AsyncInMemoryCache
|
||
# Values: async, memory, redis
|
||
# Example: LANGFLOW_CACHE_TYPE=memory
|
||
# If you want to use redis then the following environment variables must be set:
|
||
# LANGFLOW_REDIS_HOST (default: localhost)
|
||
# LANGFLOW_REDIS_PORT (default: 6379)
|
||
# LANGFLOW_REDIS_DB (default: 0)
|
||
# LANGFLOW_REDIS_CACHE_EXPIRE (default: 3600)
|
||
LANGFLOW_CACHE_TYPE=
|
||
|
||
# Set LANGFLOW_AUTO_LOGIN to false if you want to disable auto login
|
||
# and use the login form to login. LANGFLOW_SUPERUSER and LANGFLOW_SUPERUSER_PASSWORD
|
||
# must be set if AUTO_LOGIN is set to false
|
||
# Values: true, false
|
||
LANGFLOW_AUTO_LOGIN=
|
||
|
||
# SET LANGFLOW_ENABLE_SUPERUSER_CLI to false to disable
|
||
# superuser creation via the CLI
|
||
LANGFLOW_ENABLE_SUPERUSER_CLI=
|
||
|
||
# Superuser username
|
||
# Example: LANGFLOW_SUPERUSER=admin
|
||
LANGFLOW_SUPERUSER=
|
||
|
||
# Superuser password
|
||
# Example: LANGFLOW_SUPERUSER_PASSWORD=123456
|
||
LANGFLOW_SUPERUSER_PASSWORD=
|
||
|
||
# API Key Source
|
||
# Controls how API keys are validated for the x-api-key header
|
||
# Values: db, env
|
||
# - db (default): Validates against API keys stored in the database
|
||
# - env: Validates against the LANGFLOW_API_KEY environment variable
|
||
# Example: LANGFLOW_API_KEY_SOURCE=db
|
||
LANGFLOW_API_KEY_SOURCE=
|
||
|
||
# API Key (only used when LANGFLOW_API_KEY_SOURCE=env)
|
||
# The API key to use for authentication when API_KEY_SOURCE is set to 'env'
|
||
# This allows injecting a pre-defined API key via environment variables
|
||
# (useful for Kubernetes Secrets, CI/CD pipelines, etc.)
|
||
# Example: LANGFLOW_API_KEY=your-secure-api-key
|
||
LANGFLOW_API_KEY=
|
||
|
||
# Should store environment variables in the database
|
||
# Values: true, false
|
||
LANGFLOW_STORE_ENVIRONMENT_VARIABLES=
|
||
|
||
# SSRF (Server-Side Request Forgery) Protection
|
||
# When enabled, blocks requests to private IP ranges, localhost, and cloud metadata endpoints
|
||
# Values: true, false
|
||
# Default: false (for backward compatibility)
|
||
# Set to true to enable protection against SSRF attacks
|
||
LANGFLOW_SSRF_PROTECTION_ENABLED=
|
||
|
||
# SSRF Allowed Hosts
|
||
# Comma-separated list of hosts/IPs/CIDR ranges to allow despite SSRF protection
|
||
# Supports: exact hostnames, wildcard domains (*.example.com), exact IPs, CIDR ranges
|
||
# Example: LANGFLOW_SSRF_ALLOWED_HOSTS=internal-api.company.local,192.168.1.0/24,*.dev.internal
|
||
# Note: Only takes effect when LANGFLOW_SSRF_PROTECTION_ENABLED=true
|
||
LANGFLOW_SSRF_ALLOWED_HOSTS=
|
||
|
||
# Should enable the MCP composer feature in MCP projects
|
||
# Values: true, false
|
||
# Default: true
|
||
LANGFLOW_MCP_COMPOSER_ENABLED=
|
||
|
||
# STORE_URL
|
||
# Example: LANGFLOW_STORE_URL=https://api.langflow.store
|
||
# LANGFLOW_STORE_URL=
|
||
|
||
# DOWNLOAD_WEBHOOK_URL
|
||
#
|
||
# LANGFLOW_DOWNLOAD_WEBHOOK_URL=
|
||
|
||
# LIKE_WEBHOOK_URL
|
||
#
|
||
# LANGFLOW_LIKE_WEBHOOK_URL=
|
||
|
||
# Value must finish with slash /
|
||
#BACKEND_URL=http://localhost:7860/
|
||
BACKEND_URL=
|