Files
langflow/.env.example
Ram Gopal Srikar Katakam 6eaa938535 fix: add SSRF protection to URL component (PVR0699081) (#11996)
* fix: add SSRF protection to URL component (PVR0699081)

Add Server-Side Request Forgery (SSRF) protection to the URL component
by integrating the existing validate_url_for_ssrf function. This prevents
the component from being used to access internal resources like localhost,
private IP ranges, and cloud metadata endpoints.

The fix uses warn_only=True for backwards compatibility, matching the
behavior of the API Request component. Full blocking will be enabled
in the next major version (2.0).

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* fix: enforce SSRF blocking and add env variables to .env.example

- Change warn_only=False to actually block internal URLs when SSRF protection is enabled
- Add LANGFLOW_SSRF_PROTECTION_ENABLED and LANGFLOW_SSRF_ALLOWED_HOSTS to .env.example
- Update tests to reflect blocking mode

When LANGFLOW_SSRF_PROTECTION_ENABLED=true, requests to private IPs,
localhost, and cloud metadata endpoints will be blocked.

* fix: correct .env.example to show empty default for SSRF protection

The default is false, so .env.example should be empty (not true).

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* fix: add SSRF protection to URL component (PVR0699081)

Add Server-Side Request Forgery (SSRF) protection to the URL component
by integrating the existing validate_url_for_ssrf function. This prevents
the component from being used to access internal resources like localhost,
private IP ranges, and cloud metadata endpoints.

The fix uses warn_only=True for backwards compatibility, matching the
behavior of the API Request component. Full blocking will be enabled
in the next major version (2.0).

* fix: enforce SSRF blocking and add env variables to .env.example

- Change warn_only=False to actually block internal URLs when SSRF protection is enabled
- Add LANGFLOW_SSRF_PROTECTION_ENABLED and LANGFLOW_SSRF_ALLOWED_HOSTS to .env.example
- Update tests to reflect blocking mode

When LANGFLOW_SSRF_PROTECTION_ENABLED=true, requests to private IPs,
localhost, and cloud metadata endpoints will be blocked.

* fix: correct .env.example to show empty default for SSRF protection

The default is false, so .env.example should be empty (not true).

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
2026-04-03 15:51:05 +00:00

172 lines
5.3 KiB
Plaintext
Raw Permalink Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# Description: Example of .env file
# Usage: Copy this file to .env and change the values
# according to your needs
# Do not commit .env file to git
# Do not change .env.example file
# Config directory
# Directory where files, logs and database will be stored
# Example: LANGFLOW_CONFIG_DIR=~/.langflow
LANGFLOW_CONFIG_DIR=
# Save database in the config directory
# Values: true, false
# If false, the database will be saved in Langflow's root directory
# This means that the database will be deleted when Langflow is uninstalled
# and that the database will not be shared between different virtual environments
# Example: LANGFLOW_SAVE_DB_IN_CONFIG_DIR=true
LANGFLOW_SAVE_DB_IN_CONFIG_DIR=
# Database URL
# Postgres example: LANGFLOW_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/langflow
# SQLite example:
LANGFLOW_DATABASE_URL=sqlite:///./langflow.db
# Alembic logs path flag. If set to true, Alembic will log to stdout.
LANGFLOW_ALEMBIC_LOG_TO_STDOUT=False
# mem0 creates a directory
# for chat history, vector stores, and other artifacts
# its default path is ~/.mem0.
# we can change this path with
# environment variable "MEM0_DIR"
# Example: MEM0_DIR=/tmp/.mem0
# composio creates a cache directory
# for file uploads/downloads.
# its default path is ~/.composio
# we can change this path with
# environment variable "COMPOSIO_CACHE_DIR"
# Example: COMPOSIO_CACHE_DIR=/tmp/.composio
# Database connection retry
# Values: true, false
# If true, the database will retry to connect to the database if it fails
# Example: LANGFLOW_DATABASE_CONNECTION_RETRY=true
LANGFLOW_DATABASE_CONNECTION_RETRY=false
# Cache type
LANGFLOW_LANGCHAIN_CACHE=SQLiteCache
# Server host
# Example: LANGFLOW_HOST=localhost
LANGFLOW_HOST=
# Worker processes
# Example: LANGFLOW_WORKERS=1
LANGFLOW_WORKERS=
# Server port
# Example: LANGFLOW_PORT=7860
LANGFLOW_PORT=
# Logging level
# Example: LANGFLOW_LOG_LEVEL=critical
LANGFLOW_LOG_LEVEL=
# Path to the log file
# Example: LANGFLOW_LOG_FILE=logs/langflow.log
LANGFLOW_LOG_FILE=
# Time/Size for log to rotate
# Example: LANGFLOW_LOG_ROTATION=10 MB/1 day
LANGFLOW_LOG_ROTATION=
# Path to the frontend directory containing build files
# Example: LANGFLOW_FRONTEND_PATH=/path/to/frontend/build/files
LANGFLOW_FRONTEND_PATH=
# Whether to open the browser after starting the server
# Values: true, false
# Example: LANGFLOW_OPEN_BROWSER=true
LANGFLOW_OPEN_BROWSER=
# Whether to remove API keys from the projects saved in the database
# Values: true, false
# Example: LANGFLOW_REMOVE_API_KEYS=false
LANGFLOW_REMOVE_API_KEYS=
# Whether to use RedisCache or ThreadingInMemoryCache or AsyncInMemoryCache
# Values: async, memory, redis
# Example: LANGFLOW_CACHE_TYPE=memory
# If you want to use redis then the following environment variables must be set:
# LANGFLOW_REDIS_HOST (default: localhost)
# LANGFLOW_REDIS_PORT (default: 6379)
# LANGFLOW_REDIS_DB (default: 0)
# LANGFLOW_REDIS_CACHE_EXPIRE (default: 3600)
LANGFLOW_CACHE_TYPE=
# Set LANGFLOW_AUTO_LOGIN to false if you want to disable auto login
# and use the login form to login. LANGFLOW_SUPERUSER and LANGFLOW_SUPERUSER_PASSWORD
# must be set if AUTO_LOGIN is set to false
# Values: true, false
LANGFLOW_AUTO_LOGIN=
# SET LANGFLOW_ENABLE_SUPERUSER_CLI to false to disable
# superuser creation via the CLI
LANGFLOW_ENABLE_SUPERUSER_CLI=
# Superuser username
# Example: LANGFLOW_SUPERUSER=admin
LANGFLOW_SUPERUSER=
# Superuser password
# Example: LANGFLOW_SUPERUSER_PASSWORD=123456
LANGFLOW_SUPERUSER_PASSWORD=
# API Key Source
# Controls how API keys are validated for the x-api-key header
# Values: db, env
# - db (default): Validates against API keys stored in the database
# - env: Validates against the LANGFLOW_API_KEY environment variable
# Example: LANGFLOW_API_KEY_SOURCE=db
LANGFLOW_API_KEY_SOURCE=
# API Key (only used when LANGFLOW_API_KEY_SOURCE=env)
# The API key to use for authentication when API_KEY_SOURCE is set to 'env'
# This allows injecting a pre-defined API key via environment variables
# (useful for Kubernetes Secrets, CI/CD pipelines, etc.)
# Example: LANGFLOW_API_KEY=your-secure-api-key
LANGFLOW_API_KEY=
# Should store environment variables in the database
# Values: true, false
LANGFLOW_STORE_ENVIRONMENT_VARIABLES=
# SSRF (Server-Side Request Forgery) Protection
# When enabled, blocks requests to private IP ranges, localhost, and cloud metadata endpoints
# Values: true, false
# Default: false (for backward compatibility)
# Set to true to enable protection against SSRF attacks
LANGFLOW_SSRF_PROTECTION_ENABLED=
# SSRF Allowed Hosts
# Comma-separated list of hosts/IPs/CIDR ranges to allow despite SSRF protection
# Supports: exact hostnames, wildcard domains (*.example.com), exact IPs, CIDR ranges
# Example: LANGFLOW_SSRF_ALLOWED_HOSTS=internal-api.company.local,192.168.1.0/24,*.dev.internal
# Note: Only takes effect when LANGFLOW_SSRF_PROTECTION_ENABLED=true
LANGFLOW_SSRF_ALLOWED_HOSTS=
# Should enable the MCP composer feature in MCP projects
# Values: true, false
# Default: true
LANGFLOW_MCP_COMPOSER_ENABLED=
# STORE_URL
# Example: LANGFLOW_STORE_URL=https://api.langflow.store
# LANGFLOW_STORE_URL=
# DOWNLOAD_WEBHOOK_URL
#
# LANGFLOW_DOWNLOAD_WEBHOOK_URL=
# LIKE_WEBHOOK_URL
#
# LANGFLOW_LIKE_WEBHOOK_URL=
# Value must finish with slash /
#BACKEND_URL=http://localhost:7860/
BACKEND_URL=