Skip to content

docs: langflow 1.5 auto-login security doc #9057

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mendonk merged 11 commits into from
Jul 23, 2025
Merged

docs: langflow 1.5 auto-login security doc #9057

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
9522276
langflow-auto-login-security-doc
mendonk Jul 15, 2025
a164129
trailing-space
mendonk Jul 15, 2025
dbde843
auto-not-auth
mendonk Jul 15, 2025
9bd7c3d
clarify-new-behavior
mendonk Jul 15, 2025
085626c
Merge branch 'main' into docs-security-notice-recommendation
aimurphy Jul 17, 2025
630350e
Merge branch 'main' into docs-security-notice-recommendation
mendonk Jul 22, 2025
22a94b2
env-var-default
mendonk Jul 22, 2025
7c9c22a
security-md-and-var-names
mendonk Jul 22, 2025
9d26a86
Apply suggestions from code review
mendonk Jul 23, 2025
c87d644
Update docs/docs/Configuration/environment-variables.mdx
mendonk Jul 23, 2025
04f7887
Update docs/docs/Configuration/configuration-authentication.mdx
mendonk Jul 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,3 +49,14 @@ Langflow allows users to define and run **custom code components** through endpo
This means an attacker could send malicious code to the endpoint and have it executed on the server—leading to full system compromise, including data theft, remote shell access, or lateral movement within the network.

To address, upgrade to >= 1.3.0.

### No API key required if running Langflow with `LANGFLOW_AUTO_LOGIN=true` and `LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true`

In Langflow versions earlier than 1.5, if `LANGFLOW_AUTO_LOGIN=true`, then Langflow automatically logs users in as a superuser without requiring authentication. In this case, API requests don't require a Langflow API key.

In Langflow version 1.5, a Langflow API key is required to authenticate requests.
Setting `LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true` and `LANGFLOW_AUTO_LOGIN=true` skips authentication for API requests. However, the `LANGFLOW_SKIP_AUTH_AUTO_LOGIN` option will be removed in v1.6.

`LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true` is the default behavior, so users do not need to change existing workflows in 1.5. To update your workflows to require authentication, set `LANGFLOW_SKIP_AUTH_AUTO_LOGIN=false`.

For more information, see [Authentication](https://docs.langflow.org/configuration-authentication).
6 changes: 3 additions & 3 deletions docs/docs/Configuration/configuration-api-keys.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,11 @@ The only exceptions are the MCP endpoints `/v1/mcp`, `/v1/mcp-projects`, and `/v
<details>
<summary>AUTO_LOGIN and SKIP_AUTH options</summary>

In Langflow versions earlier than 1.5, if `AUTO_LOGIN=true`, then Langflow automatically logs users in as a superuser without requiring authentication.
In Langflow versions earlier than 1.5, if `LANGFLOW_AUTO_LOGIN=true`, then Langflow automatically logs users in as a superuser without requiring authentication.
In this case, API requests don't require a Langflow API key.

In Langflow version 1.5, you can set `SKIP_AUTH_AUTO_LOGIN=true` and `AUTO_LOGIN=true` to skip authentication for API requests.
However, the `SKIP_AUTH_AUTO_LOGIN` option will be removed in a future release.
In Langflow version 1.5, you can set `LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true` and `LANGFLOW_AUTO_LOGIN=true` to skip authentication for API requests.
However, the `LANGFLOW_SKIP_AUTH_AUTO_LOGIN` option will be removed in a future release.
</details>

## Generate a Langflow API key
Expand Down
6 changes: 3 additions & 3 deletions docs/docs/Configuration/configuration-authentication.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,11 +36,11 @@ The only exceptions are the MCP endpoints `/v1/mcp`, `/v1/mcp-projects`, and `/v
<details>
<summary>AUTO_LOGIN and SKIP_AUTH options</summary>

In Langflow versions earlier than 1.5, if `AUTO_LOGIN=true`, then Langflow automatically logs users in as a superuser without requiring authentication.
In Langflow versions earlier than 1.5, if `LANGFLOW_AUTO_LOGIN=true`, then Langflow automatically logs users in as a superuser without requiring authentication.
In this case, API requests don't require a Langflow API key.

In Langflow version 1.5, you can set `SKIP_AUTH_AUTO_LOGIN=true` and `AUTO_LOGIN=true` to skip authentication for API requests.
However, the `SKIP_AUTH_AUTO_LOGIN` option will be removed in a future release.
In Langflow version 1.5, you can set `LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true` and `LANGFLOW_AUTO_LOGIN=true` to skip authentication for API requests.
However, the `LANGFLOW_SKIP_AUTH_AUTO_LOGIN` option will be removed in a future release.
</details>

### LANGFLOW_SUPERUSER and LANGFLOW_SUPERUSER_PASSWORD
Expand Down
2 changes: 1 addition & 1 deletion docs/docs/Configuration/environment-variables.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,7 +240,7 @@ The following table lists the environment variables supported by Langflow.
| <Link id="LANGFLOW_WORKERS"/><span class="env-prefix">LANGFLOW_</span>WORKERS | Integer | `1` | Number of worker processes.<br/>See [`--workers` option](./configuration-cli.mdx#run-workers). |
| <Link id="LANGFLOW_SSL_CERT_FILE"/><span class="env-prefix">LANGFLOW_</span>SSL_CERT_FILE | String | Not set | Path to the SSL certificate file on the local system. |
| <Link id="LANGFLOW_SSL_KEY_FILE"/><span class="env-prefix">LANGFLOW_</span>SSL_KEY_FILE | String | Not set | Path to the SSL key file on the local system. |
| <Link id="SKIP_AUTH_AUTO_LOGIN"/>SKIP_AUTH_AUTO_LOGIN | Boolean | `false` | If set to `true`, disables automatic login and enforces authentication, regardless of the value of `LANGFLOW_AUTO_LOGIN`.
| <Link id="LANGFLOW_SKIP_AUTH_AUTO_LOGIN"/><span class="env-prefix">LANGFLOW_</span>SKIP_AUTH_AUTO_LOGIN | Boolean | `true` | If set to `true`, and `LANGFLOW_AUTO_LOGIN` is set to `true`, skips authentication and allows automatic login as the superuser. If set to `false`, and `LANGFLOW_AUTO_LOGIN` is set to `true`, disables automatic login and enforces authentication. If `LANGFLOW_AUTO_LOGIN` is `false`, has no effect. |
</div>


Expand Down