docs: CORS configuration

[mendonk]

This pull request adds documentation for new CORS-related environment variables and clarifies how to configure cross-origin requests and credentials.
TODO: Add Warning to 1.6 Release Notes for 1.7 changes: that when using wildcard origins, credentials will be automatically disabled.

#9744

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

Documentation updates introduce CORS-related configuration details for authentication, adding LANGFLOW_CORS_ORIGINS and LANGFLOW_CORS_ALLOW_CREDENTIALS to docs. The authentication page includes a new CORS section (duplicated twice). The environment variables page adds both variables to tables with descriptions and examples. No code or API changes.

Changes

Cohort / File(s)	Summary of changes
Auth docs CORS section docs/docs/Configuration/api-keys-and-authentication.mdx	Added a CORS configuration section covering LANGFLOW_CORS_ORIGINS and LANGFLOW_CORS_ALLOW_CREDENTIALS, default behaviors, production guidance, env var examples, and a JWT curl example; note: the entire section appears twice in the file.
Environment variables tables docs/docs/Configuration/environment-variables.mdx	Added LANGFLOW_CORS_ORIGINS and LANGFLOW_CORS_ALLOW_CREDENTIALS to two env var tables with descriptions, defaults, and example values; documentation-only changes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

documentation, lgtm

Suggested reviewers

• jordanrfrazier
• aimurphy

✨ Finishing touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch docs-cors-configuration-env-vars

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (3)

docs/docs/Configuration/api-keys-and-authentication.mdx (1)

1-4: Add required frontmatter description.

Docs must include a description in frontmatter. Add a concise summary for SEO and consistency.

Apply:

 ---
 title: API keys and authentication
 slug: /api-keys-and-authentication
+description: Configure API keys, authentication, and CORS for Langflow in development and production.
 ---

docs/docs/Configuration/environment-variables.mdx (2)

1-4: Add required frontmatter description.

Frontmatter is missing description; include a brief summary.

Apply:

 ---
 title: Environment variables
 slug: /environment-variables
+description: Reference and examples for configuring Langflow using environment variables across environments.
 ---

---

1-4: Add missing frontmatter description
The frontmatter only includes title and slug—you need to add a description: <brief summary> entry at the top of docs/docs/Configuration/environment-variables.mdx.

🧹 Nitpick comments (2)

docs/docs/Configuration/environment-variables.mdx (2)

198-200: Clarify origin list formatting to avoid parsing issues.

Explicitly note “no spaces” in comma-separated origins; this trips users frequently.

Apply:

-| `LANGFLOW_CORS_ORIGINS` | String | `*` | Comma-separated list of allowed CORS origins. Use `*` for wildcard (credentials automatically disabled for security), or specify specific origins like `https://yourdomain.com,https://anotherdomain.com`. |
+| `LANGFLOW_CORS_ORIGINS` | String | `*` | Comma-separated list of allowed CORS origins (no spaces). Use `*` for wildcard (credentials automatically disabled), or specify origins like `https://yourdomain.com,https://anotherdomain.com`. |

---

198-199: CORS behavior note (accurate but easy to misread).

“Only works when … not *” is correct; consider adding “per CORS spec, credentials cannot be used with wildcard origins.”

Apply (small wording tweak):

-| `LANGFLOW_CORS_ALLOW_CREDENTIALS` | Boolean | False | Whether to allow credentials such as cookies and authorization headers in CORS requests. Only works when `LANGFLOW_CORS_ORIGINS` is set to specific origins (not `*`). |
+| `LANGFLOW_CORS_ALLOW_CREDENTIALS` | Boolean | False | Whether to allow credentials (cookies, Authorization header) in CORS requests. Per the CORS spec, this only works when `LANGFLOW_CORS_ORIGINS` lists specific origins (not `*`). |

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4144d76 and a0fe629.

📒 Files selected for processing (2)

• docs/docs/Configuration/api-keys-and-authentication.mdx (1 hunks)
• docs/docs/Configuration/environment-variables.mdx (1 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

docs/docs/**/*.{md,mdx}

📄 CodeRabbit inference engine (.cursor/rules/docs_development.mdc)

docs/docs/**/*.{md,mdx}: All documentation content must be written in Markdown or MDX files located under docs/docs/, following the prescribed directory structure for guides, reference, how-to, concepts, and API documentation.
All documentation Markdown and MDX files must begin with a frontmatter block including at least title and description fields.
Use admonitions (:::tip, :::warning, :::danger) in Markdown/MDX files to highlight important information, warnings, or critical issues.
All images referenced in documentation must include descriptive alt text for accessibility.
All code examples included in documentation must be tested and verified to work as shown.
Internal links in documentation must be functional and not broken.
Content must follow the style guide: professional but approachable tone, second person voice, present tense, short paragraphs, sentence case headers, inline code with backticks, bold for UI elements, italic for emphasis, and parallel structure in lists.
Use consistent terminology: always capitalize Langflow, Component, Flow, and uppercase API and JSON.

Files:

• docs/docs/Configuration/api-keys-and-authentication.mdx
• docs/docs/Configuration/environment-variables.mdx

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

• GitHub Check: Validate PR
• GitHub Check: Test Docs Build / Test Docs Build
• GitHub Check: build-and-deploy

🔇 Additional comments (1)

docs/docs/Configuration/api-keys-and-authentication.mdx (1)

316-316: Internal link target exists and resolves correctly.

[aimurphy]

approved with suggestions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Build successful! ✅
Deploying docs draft.
Deploy successful! View draft