{"record":{"id":"7e5724584ae5ff06","repo":"langflow-ai/langflow","slug":"job-not-found","errorCode":null,"errorMessage":"Job not found","messagePattern":"Job not found","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"warning","filePath":"src/backend/base/langflow/api/v1/chat.py","lineNumber":978,"sourceCode":"    return await get_flow_events_response(\n        job_id=job_id,\n        queue_service=queue_service,\n        event_delivery=event_delivery,\n    )\n\n\nasync def _assert_public_job(job_id: str, queue_service: JobQueueService) -> None:\n    \"\"\"Raise HTTP 404 if job_id was not registered through the public build endpoint.\n\n    Prevents unauthenticated callers from reading or cancelling private-flow\n    builds by guessing or leaking a job_id.\n\n    Why 404 not 403: returning 403 would confirm the job exists under a different\n    access tier, leaking information about private builds. 404 is neutral.\n    \"\"\"\n    if not await queue_service.is_public_job_async(job_id):\n        # Static detail — do not reflect job_id back; avoid confirming which IDs exist.\n        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=\"Job not found\")\n\n\n@router.get(\"/build_public_tmp/{job_id}/events\")\nasync def get_build_events_public(\n    job_id: str,\n    queue_service: Annotated[JobQueueService, Depends(get_queue_service)],\n    *,\n    event_delivery: EventDeliveryType = EventDeliveryType.STREAMING,\n):\n    \"\"\"Get events for a public flow build job.\n\n    This endpoint does not require authentication, matching the public build endpoint.\n    It is used by the shareable playground to consume build events.\n    \"\"\"\n    await _assert_public_job(job_id, queue_service)\n    return await get_flow_events_response(\n        job_id=job_id,\n        queue_service=queue_service,","sourceCodeStart":960,"sourceCodeEnd":996,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/chat.py#L960-L996","documentation":"Raised as HTTP 404 with static detail 'Job not found' by _assert_public_job when queue_service.is_public_job_async(job_id) returns False — the job id was never registered through the public build path. The static message is deliberate: reflecting the job_id or returning 403 would confirm which ids exist under other access tiers, leaking information about private builds.","triggerScenarios":"Hitting GET /build_public_tmp/{job_id}/events or the public cancel endpoint with: a private build's job_id, a guessed/random id, or a public job id whose marker expired in Redis.","commonSituations":"Attempting to read or cancel another user's build by replaying a leaked job_id; job marker TTL expiring before the events stream is opened; Redis flush removing public markers.","solutions":["Only use job ids returned by the public build endpoint itself, with public (share) flows.","For authenticated builds, use the authenticated events/cancel endpoints, not the public ones.","Open the events stream promptly after starting the public build so the marker is still live.","Treat 404 as 'not a public job' — do not retry the same id; start a new public build instead."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Only call public endpoints with ids from the public build path\nassert job_id.startswith(\"public-\") or job_id in known_public_job_ids, \"Not a public job\"","typeGuard":null,"tryCatchPattern":"try:\n    res = await client.get(f\"/api/v1/chat/build_public_tmp/{job_id}/events\")\nexcept httpx.HTTPStatusError as e:\n    if e.response.status_code == 404:\n        stop_polling(job_id)  # static detail; id is not a public job, do not retry\n        return\n    raise","preventionTips":["Never use authenticated builds' job ids on public endpoints (and vice versa).","Open the events stream immediately after the public build starts.","Remember 404 is intentionally uninformative — it also masks private jobs."],"tags":["langflow","public-flow","security","http-404"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}