{"record":{"id":"2e8c2b6e1c7ed9b7","repo":"infiniflow/ragflow","slug":"ip-client-ip-is-not-allowed-by-whitelist","errorCode":null,"errorMessage":"IP {client_ip} is not allowed by whitelist","messagePattern":"IP (.+?) is not allowed by whitelist","errorType":"exception","errorClass":"Exception","httpStatus":400,"severity":"error","filePath":"api/apps/restful_apis/agent_api.py","lineNumber":1970,"sourceCode":"    def _validate_ip_whitelist(security_cfg):\n        \"\"\"Allow only IPs listed in ip_whitelist.\"\"\"\n        whitelist = security_cfg.get(\"ip_whitelist\", [])\n        if not whitelist:\n            return\n\n        client_ip = request.remote_addr\n\n        for rule in whitelist:\n            if \"/\" in rule:\n                # CIDR notation\n                if ipaddress.ip_address(client_ip) in ipaddress.ip_network(rule, strict=False):\n                    return\n            else:\n                # Single IP\n                if client_ip == rule:\n                    return\n\n        raise Exception(f\"IP {client_ip} is not allowed by whitelist\")\n\n    def _validate_rate_limit(security_cfg):\n        \"\"\"Simple in-memory rate limiting.\"\"\"\n        rl = security_cfg.get(\"rate_limit\")\n        if not rl:\n            rl = {\"limit\": 60, \"per\": \"minute\"}\n\n        limit = int(rl.get(\"limit\", 60))\n        if limit <= 0:\n            raise Exception(\"rate_limit.limit must be > 0\")\n        per = rl.get(\"per\", \"minute\")\n\n        window = {\n            \"second\": 1,\n            \"minute\": 60,\n            \"hour\": 3600,\n            \"day\": 86400,\n        }.get(per)","sourceCodeStart":1952,"sourceCodeEnd":1988,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/api/apps/restful_apis/agent_api.py#L1952-L1988","documentation":"Error \"IP {client_ip} is not allowed by whitelist\" thrown in infiniflow/ragflow.","triggerScenarios":"Thrown at api/apps/restful_apis/agent_api.py:1970 when the library encounters an invalid state.","commonSituations":"A webhook request originates from an IP not present in the configured whitelist, commonly after a client network change; updating the whitelist prevents this error.","solutions":["Add the client IP to the webhook IP whitelist.","Call the webhook from an allowed network."],"exampleFix":"webhook_config = {'ip_whitelist': ['203.0.113.10']}","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}