Client error '403 Forbidden' for url ******

[gubinjie]

Self Checks

• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
• [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
• Please do not modify this template :) and fill in all the required fields.

1. Is this request related to a challenge you're experiencing? Tell me about your story.

My dify access path is 192.168.104.11:180, and when I upload files in workflow, I encounter "
Client error '403 Forbidden' for url 'http://192.168.104.11:180/files/21297ed8-b358-449b-b1ea-32e2d36de8e3/file-preview?timestamp=1767765195&nonce=a758a04fbda3833ec6bda3f19993273b&sign=KoQ4yRruLeH5ykYC2UdQjuW0EaNiaHDDK7hM6qS1f94%3D'
For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403“，

I already have "FILES_URL=http://192.168.104.11:180" configured in the .env file, is there anything else I need to do?

2. Additional context or comments

No response

[dosubot[bot]]

The most common causes of a 403 Forbidden error for file upload or preview in Dify are: an incorrect or missing FILES_URL in your .env (it must match the external address you use to access Dify, including protocol and port), not restarting your Dify services after changing FILES_URL, or a mismatch in the SECRET_KEY used for signing file URLs. Also, the file preview endpoint strictly checks the signed parameters (timestamp, nonce, sign) in the URL—if the signature is invalid or expired, access is denied example code reference.

Other things to check: make sure you are authenticated in the Dify UI, file upload is enabled in your configuration, and your SSRF proxy (if used) allows requests to your server’s IP/port. CORS misconfiguration can also cause 403 errors—set WEB_API_CORS_ALLOW_ORIGINS and CONSOLE_CORS_ALLOW_ORIGINS to your frontend URL if needed example.

If you’ve already set FILES_URL correctly and restarted, try setting LOG_LEVEL=DEBUG in your .env and check the API container logs for more details about the error. If you want, share any relevant log messages here for further help.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[gubinjie]

I can access this string of URLs directly, but it seems that Dify's API service cannot

[dosubot[bot]]

This usually happens because Dify's API service accesses file URLs through its SSRF proxy (Squid), which enforces strict domain and port whitelisting. Your browser can reach the URL directly, but the API service is blocked if the IP or port (e.g., 192.168.104.11:180) isn't allowed in docker/ssrf_proxy/squid.conf.template—even if you can access it outside Dify. To fix this, add your server's IP to the allowed_domains ACL and port 180 to the Safe_ports ACL in that file, then restart the ssrf_proxy container and Dify. Also, make sure http_access deny all is commented out or properly configured so your custom ACLs take effect.

If you still get a 403, check the SSRF proxy logs (/var/log/squid/access.log and error.log) for clues about what's being blocked. Let me know if you want help interpreting your Squid config or logs.

References:

• SSRF proxy and allowed_domains explanation
• Safe_ports and proxy restart details
• How Dify routes file preview requests through the SSRF proxy

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[gubinjie]

@dosu
I've added acl Safe_ports port 180 and now the error is Client error '404 Not Found' for url 'http://192.168.104.11:180/files/bce54e18-3511-4a6d-88af-310ba3b777de/file-preview?timestamp=1767767160&nonce=0dee20e3f57090924c8381891c39ffd1&sign=4KKpmu0PbsYdejTC1xMJM0qov_QPQps56Mx44eJBT2k%3D'
For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/404

[dosubot[bot]]

Now that the 403 is resolved, a 404 Not Found for file preview in Dify usually means one of these:

• The file with that ID doesn't exist in the database, or it was deleted, or the signature in the URL is invalid or expired (signature validation is strict and any mismatch or timeout returns 404) cite.
• Most importantly: if you uploaded the file via a workflow and not through a chat message, Dify does not allow previewing it—file preview only works for files linked to messages in chat apps, not for temporary workflow uploads. This is by design for security and cleanup reasons cite.

If you need to preview files uploaded in a workflow, you must send them in a chat message first. Otherwise, preview will always return 404.

If you believe the file should be accessible, double-check that the file is present in both the UploadFile and MessageFile tables and linked to a message. Also, make sure your FILES_URL is correct and matches the public address, and that INTERNAL_FILES_URL is unset or set correctly. After any config change, restart all containers.

If you want to rule out proxy misrouting, check your SSRF proxy config: add http_access allow localnet before http_access deny all in your squid.conf.template and restart the ssrf_proxy container cite.

Let me know if you want help checking logs or database records for a specific file.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[heathdutton]

The 403 on /files/... usually means nginx (or your reverse proxy) is blocking the request before it reaches Dify.

Check these:

1. Nginx config - make sure the /files/ location is proxied correctly:

location /files/ {
    proxy_pass http://api:5001/files/;
    # ... other proxy headers
}

2. CONSOLE_API_URL and FILES_URL should both match your external access URL (with port if non-standard)

3. If using a reverse proxy, ensure X-Forwarded-For and X-Forwarded-Proto headers are being passed

4. Check if your proxy has any rate limiting or WAF rules blocking signed URLs

Does that point you in the right direction?