Question: 401 Unauthorized error when downloading knowledge base documents from Dify chatbot embedded in iframe

[xiaomenger123]

Self Checks

• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
• [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
• Please do not modify this template :) and fill in all the required fields.

Content

Describe the issue

I have embedded the Dify chatbot iframe into my application system. When the chatbot lists the knowledge base documents in the conversation and I click on a file to download it in the chatbot dialog, the download fails.

The browser console shows the following error:
https://dify-server-address/console/api/datasets/7ae085bd-5839-4d97-8881-23e18532ffe9/documents/95e91f75-984c-455a-b9da-0185946db23e/download:1 Failed to load resource: the server responded with a status of 401 (UNAUTHORIZED)

And the browser also prompts: "The application system domain name refused our connection request."

Expected behavior

When clicking on a knowledge base document in the Dify chatbot embedded in iframe, the document should be downloaded successfully without 401 errors.

Steps to reproduce

1. Embed Dify chatbot iframe into the application system.
2. Initiate a conversation in the chatbot to list knowledge base documents.
3. Click on a document to download.
4. Observe the 401 Unauthorized error in the browser console.

Additional context

• The application system and Dify are deployed on different domains.
• The download request from the iframe does not carry valid authentication credentials, leading to the 401 error.

[dosubot[bot]]

This is a known issue. The root cause is that the document download endpoint (/console/api/datasets/.../download) is part of the console API, which requires admin-level authentication (Flask-Login session + CSRF tokens). This authentication isn't available in public chatbot iframe embeddings.

Here are some things to try:

1. Enable iframe embedding - Set NEXT_PUBLIC_ALLOW_EMBED=true in your environment variables to remove the blocking X-Frame-Options header

2. Configure CORS - Add your application domain to CONSOLE_CORS_ALLOW_ORIGINS environment variable

3. Use HTTPS consistently - Ensure both your application and Dify use HTTPS, as protocol mismatches (HTTP vs HTTPS) cause localStorage token access failures due to browser scope isolation

4. Upgrade to Dify 1.8.0+ - This version includes improvements for iframe embedding and token handling

5. Verify your embed token - Ensure your difyChatbotConfig object has a valid access token

That said, even with these configurations, the fundamental issue is that the download endpoint requires console-level authentication which may not be fully compatible with public chatbot embeddings. This might require a feature request for a public-facing document download API.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[xiaomenger123]

Thanks for your reply.The chatbot is embedded using the API Key / embed token applied from the Dify admin backend.This permission should already be sufficient for normal chat and knowledge base interactions.
Since the download action is triggered inside the public chatbot interface, it should rely on the chatbot’s own token / authentication, not the console admin login session.
Could you please check if the document download function can be made to support the public chatbot embed token instead of requiring console admin auth?