github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-21 05:01:48 -05:00
Code Issues 16.9k Packages Projects Releases 122 Wiki Activity

[GH-ISSUE #5838] ollama CORS check is case-sensitive #50150

New Issue
Closed
opened 2026-04-28 14:25:51 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-28 14:25:51 -05:00
Owner
Copy Link

Originally created by @rick-github on GitHub (Jul 22, 2024).
Original GitHub issue: https://github.com/ollama/ollama/issues/5838

What is the issue?

ollama uses github.com/gin-contrib/cors to check Host header for allowed origins (OLLAMA_ORIGINS). If the value of the Host is not all lowercase, the check fails.

$ curl -D - -s -H Host:localhost localhost:11434/api/version
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Date: Mon, 22 Jul 2024 02:22:46 GMT
Content-Length: 19

{"version":"0.2.7"}

$ curl -D - -s -H Host:Localhost localhost:11434/api/version
HTTP/1.1 403 Forbidden
Date: Mon, 22 Jul 2024 02:22:53 GMT
Content-Length: 0

Adding Localhost to OLLAMA_ORIGINS doesn't work because the cors package normalizes all of the rules to lowercase.

This prevents clients that don't lowercase their Host header from sending completions (https://github.com/ollama/ollama/issues/5816)

OS

Linux, Windows

GPU

Nvidia

CPU

Intel

Ollama version

0.2.7

Originally created by @rick-github on GitHub (Jul 22, 2024). Original GitHub issue: https://github.com/ollama/ollama/issues/5838 ### What is the issue? ollama uses `github.com/gin-contrib/cors` to check `Host` header for allowed origins (`OLLAMA_ORIGINS`). If the value of the `Host` is not all lowercase, the check fails. ``` $ curl -D - -s -H Host:localhost localhost:11434/api/version HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Mon, 22 Jul 2024 02:22:46 GMT Content-Length: 19 {"version":"0.2.7"} ``` ``` $ curl -D - -s -H Host:Localhost localhost:11434/api/version HTTP/1.1 403 Forbidden Date: Mon, 22 Jul 2024 02:22:53 GMT Content-Length: 0 ``` Adding `Localhost` to `OLLAMA_ORIGINS` doesn't work because the `cors` package normalizes all of the rules to lowercase. This prevents clients that don't lowercase their `Host` header from sending completions (https://github.com/ollama/ollama/issues/5816) ### OS Linux, Windows ### GPU Nvidia ### CPU Intel ### Ollama version 0.2.7
GiteaMirror added the bugapi labels 2026-04-28 14:26:03 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label api bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#50150
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?