SSRF Proxy#

Dify routes all outbound HTTP requests through a Squid-based SSRF proxy layer to prevent Server-Side Request Forgery. The system has two components:

1. Squid sidecar containers — enforce network-level ACL rules (deny-by-default since v1.15.0)
2. API-layer client — api/core/helper/ssrf_proxy.py — handles transport, retries, SSL verification, and error translation

Two independent Squid services run in Docker 1:

The API container connects to Squid via SSRF_PROXY_HTTP_URL / SSRF_PROXY_HTTPS_URL (or SSRF_PROXY_ALL_URL) 2. When no proxy URL is set, the client falls back to a direct connection with no SSRF protection.

Note: ssrf_proxy.py is for outbound API calls only — remote file downloads belong in core.file.remote_fetcher 3.

Retry Logic & Exponential Backoff#

make_request() runs its own retry loop:

• Retried status codes (STATUS_FORCELIST): 429, 500, 502, 503, 504 4
• Backoff formula: sleep(0.5 × 2^(retry - 1)) → 0.5 s, 1 s, 2 s, 4 s, … 5
• Default max retries: 3, controlled by SSRF_DEFAULT_MAX_RETRIES 6
• When max_retries=0, httpx.RequestError is re-raised immediately 7
• Exhausting all retries raises MaxRetriesExceededError

⚠️ Retry Multiplication (fixed in PR #33689)#

When an HTTP Request Node has graph-level retry configured in the workflow UI, two independent retry mechanisms previously fired on the same failure. With graph retries = 5 and SSRF retries = 3, a single failure triggered 24 requests instead of 6: (3 + 1) × (5 + 1) = 24 1.

Fix: The HTTP Request node now passes max_retries=0 to make_request() when graph-level retry is active, delegating all retry control to the graph handler 8. When no graph retry is configured, SSRF retries operate at the default of 3.

Timeout Configuration#

All four httpx timeout dimensions are externalized as environment variables — defaults are 5 seconds each 9:

Callers can override any timeout by passing an explicit timeout kwarg to make_request() 10.

Squid itself enforces separate timeouts in squid-common.conf.template (connect_timeout 30s, request_timeout 2min, read_timeout 2min) — these are currently hardcoded, not configurable via environment variables 1.

Note: The pre-1.15.0 env var HTTP_REQUEST_MAX_READ_TIMEOUT no longer controls network timeouts; that is now managed by the SSRF proxy layer 8.

Squid ACL Policy#

Since v1.15.0, both proxies enforce a deny-by-default policy 11. The to_private_networks ACL blocks 14 ranges: RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback, link-local, CGN, and IPv6 equivalents 12. The only hardcoded allowlist entry is .marketplace.dify.ai 12.

SSRF detection: When Squid blocks a request with 401 or 403, make_request() checks for squid in the Server / Via response header and raises ToolSSRFError 13.

Common symptoms after upgrade to 1.15.0+ 11:

• HTTP Request nodes return 403 Forbidden surfaced as ToolSSRFError
• Worker logs show TCP_DENIED/403 in ssrf_proxy container output
• MaxRetriesExceededError when backends are slow (Squid 502 → retry loop exhausted)

Operator Allowlisting#

Both ssrf_proxy and agent_ssrf_proxy support runtime exceptions via .env 14:

At startup, docker-entrypoint.sh and docker-agent-entrypoint.sh each generate /etc/squid/dify_allow_private.conf from these variables; this file is evaluated before the private-network deny rule 12.

# .env additions
SSRF_PROXY_ALLOW_PRIVATE_DOMAINS=internal.mycompany.com,ollama
SSRF_PROXY_ALLOW_PRIVATE_IPS=10.10.5.42,192.168.1.0/24

# Apply
docker compose restart ssrf_proxy agent_ssrf_proxy

Squid Image Version Pinning#

The ssrf_proxy and agent_ssrf_proxy services use ubuntu/squid. Newer tags (e.g., ubuntu/squid:latest resolving to 7.2-26.04_beta) changed log directory ownership and pinger behavior, causing containers to crash-loop with Permission denied on /var/log/squid/cache.log and FATAL: Unable to open any ICMP sockets 15.

Workaround: Pin to a supported, stable tag such as ubuntu/squid:6.6-24.04_beta (supported until 2029) 15. The entrypoint scripts do not chown /var/log/squid/ before launching Squid, so image upgrades that change the default user can silently break both proxy containers.

Key Files#

Related: Sandbox Network Isolation 12 · Agent Sandbox SSRF Allowlisting 14 · HTTP Request Node 8 · Release Breaking Changes 11