deer-flow

mirror of https://github.com/bytedance/deer-flow.git synced 2026-05-13 12:13:46 +00:00

History

fix(nginx): defer CORS to gateway allowlist (#2861 )

* fix(nginx): defer cors to gateway allowlist

Remove proxy-level wildcard CORS handling so browser origins are controlled by the Gateway allowlist and stay aligned with CSRF origin checks.

* docs: document gateway cors allowlist

Clarify that same-origin nginx access needs no CORS headers while split-origin or port-forwarded browser clients must opt in with GATEWAY_CORS_ORIGINS.

* docs(gateway): record cors source of truth

Document that Gateway CORSMiddleware and CSRFMiddleware share GATEWAY_CORS_ORIGINS as the split-origin source of truth.

* fix(gateway): align cors origin normalization

* docs: clarify gateway langgraph routing

* docs(gateway): update runtime routing note

2026-05-11 17:38:37 +08:00

auth

fix(security): harden auth system and fix run journal logic bug (#2593 )

2026-04-28 11:34:07 +08:00

routers

fix: use backend thread token usage for header total (#2800 )

2026-05-09 19:40:32 +08:00

__init__.py

refactor: split backend into harness (deerflow.*) and app (app.*) (#1131 )

2026-03-14 22:55:52 +08:00

app.py

fix(nginx): defer CORS to gateway allowlist (#2861 )