[GH-ISSUE #1883] /api/tags open to extension without setting OLLAMA_ORIGINS #47591

Closed
opened 2026-04-28 04:25:54 -05:00 by GiteaMirror · 2 comments
Owner

Originally created by @sublimator on GitHub (Jan 10, 2024).
Original GitHub issue: https://github.com/ollama/ollama/issues/1883

I'm not sure what's going on here, I could have sworn pre 0.1.19 ALL endpoints were restricted from chrome://extensions. But it seems I can now access /api/tags, a GET request, from an extension, without setting OLLAMA_ORIGINS?

image

Opening this issue as a reminder.
Will investigate more.

Originally created by @sublimator on GitHub (Jan 10, 2024). Original GitHub issue: https://github.com/ollama/ollama/issues/1883 I'm not sure what's going on here, I could have sworn pre 0.1.19 ALL endpoints were restricted from chrome://extensions. But it seems I can now access /api/tags, a GET request, from an extension, without setting OLLAMA_ORIGINS? ![image](https://github.com/jmorganca/ollama/assets/525211/385915b5-c82f-44df-918b-fe8257879753) Opening this issue as a reminder. Will investigate more.
Author
Owner

@sublimator commented on GitHub (Jan 10, 2024):

It seems like chrome isn't sending the Origin header for GET requests in extensions. I can't recall if it's always been like that.

<!-- gh-comment-id:1884178394 --> @sublimator commented on GitHub (Jan 10, 2024): It seems like chrome isn't sending the Origin header for GET requests in extensions. I can't recall if it's always been like that.
Author
Owner

@sublimator commented on GitHub (Jan 11, 2024):

Related to #1686

<!-- gh-comment-id:1886376097 --> @sublimator commented on GitHub (Jan 11, 2024): Related to #1686
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#47591