docs: SSRF warning

[mendonk]

#10544

Summary by CodeRabbit

• Documentation
  • Added SSRF protection information for API requests, clarifying that redirect following is disabled by default to prevent security vulnerabilities.
  • Documented SSRF protection environment variables and configuration options for enhanced security control.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

Documentation updates reflecting SSRF protection features in Langflow. The changes document that the API Request component's Follow Redirects parameter defaults to false since v1.6 and introduce SSRF protection environment variable configurations available for securing API requests.

Changes

Cohort / File(s)	Summary
API Request Component Documentation docs/docs/Components/components-data.mdx	Added SSRF protection information block explaining Follow Redirects is disabled by default (false) to prevent SSRF bypass. Updated follow_redirects parameter description to clarify default value and trusted-target requirements.
Authentication and API Keys Documentation docs/docs/Develop/api-keys-and-authentication.mdx	Added new "SSRF protection" subsection documenting environment variables LANGFLOW_SSRF_PROTECTION_ENABLED and LANGFLOW_SSRF_ALLOWED_HOSTS, including formats, defaults, and behavior descriptions.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• PR #10544 — Implements SSRF protection utilities and changes API Request follow_redirects default to False, which these documentation changes reflect.
• PR #9172 — Consolidated and updated the "api-keys-and-authentication" documentation page that receives the new SSRF protection subsection.

Suggested reviewers

• jordanrfrazier
• aimurphy

Pre-merge checks and finishing touches

✅ Passed checks (7 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'docs: SSRF warning' accurately describes the main change—adding SSRF protection documentation and warnings across multiple documentation files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Test Coverage For New Implementations	✅ Passed	This PR contains only documentation changes (.mdx files) with no code modifications, bug fixes, or new functionality implementations, therefore test coverage is not applicable.
Test Quality And Coverage	✅ Passed	This PR is purely documentation-focused with no code implementation, new functionality, or API changes, thus tests are not applicable.
Test File Naming And Structure	✅ Passed	PR contains only documentation changes (.mdx files) with no test files added or modified, making this check not applicable.
Excessive Mock Usage Warning	✅ Passed	This PR contains only documentation changes to .mdx files with no test files modified or added.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[aimurphy]

approved but please see my comments

[github-actions]

Build successful! ✅
Deploying docs draft.
Deploy successful! View draft