Attachment button missing in embed on Flowise v3.0.12 (works in v2.2.7)

[meltemdanismaz]

Hi,

We are running two Flowise instances:

• v2.2.7
• v3.0.12

Both chatbots have the same configuration and attachments are enabled.

In the Share Chatbot UI:

• The attachment button appears and works in both versions.

When embedding the chatbot using flowise-embed:

• v2.2.7 → attachment button appears
• v3.0.12 → attachment button is missing

Same embed code, same website, same settings.

Embed code:

<script type="module"> import Chatbot from "https://cdn.jsdelivr.net/npm/flowise-embed/dist/web.js" Chatbot.initFull({ chatflowid: "...", apiHost: "https://flowiseai.xxxx.com" }) </script>

Screenshots:

1. Embedded chatbot (Flowise v3.0.12)
   → Attachment button is missing

2. Share Chatbot popup (Flowise v3.0.12)
   → Attachment button is visible

Is this a regression in the v3 embed, or does v3 require additional configuration
to enable attachments in embedded mode?

Thanks.

To Reproduce

1. Run Flowise v3.0.12
2. Create a chatbot and enable attachments (file upload)
3. Embed the chatbot into an external website using flowise-embed
4. Open the embedded chatbot in the browser
5. Observe that the attachment button is missing

Expected behavior

The attachment (file upload) button should be visible and usable in the embedded chatbot,
the same way it appears in the Share Chatbot UI and in Flowise v2.2.7.

Flow

No response

Use Method

None

Flowise Version

No response

Operating System

None

Browser

None

Additional context

The attachment button does not appear in the embedded chatbot in Flowise v3.0.12,
while it appears and works in v2.2.7 using the same configuration.

[prd-hoang-doan]

Hi @meltemdanismaz, could you verify the API response at step 4 by opening Dev Tools (F12) and navigating to the Network tab?
The embedded chatbot called the Flowise API to get the input's config (uploads.IsImageUploadAllowed) to determine whether to show the attachment button.

• API: api/v1/public-chatbotConfig/f0dabe43-de84-48e4-85f3-002a54819c8e

Example:

[meltemdanismaz]

Hi @prd-hoang-doan,
I tested two different chatbots that have the same configuration
(same settings, same attachment options, same embed code and same origin),
with the only difference being the Flowise version.

In Flowise v2.2.7:

• The chatbot config endpoint returns a readable JSON response.
• The response includes the uploads configuration.
• DevTools → Network → Response tab shows the JSON correctly.
• The attachment button appears in embedded mode.

In Flowise v3.0.12:

• The embedded chatbot calls
  /api/v1/public-chatbotConfig/ and receives 200 OK.
• Response headers indicate JSON with a non-zero Content-Length.
• However, the response body is not readable in the browser
  (DevTools shows “Failed to load response data”).
• Since the embed UI does not seem to receive the uploads configuration,
  the attachment button does not appear.
• The same chatbot still shows attachments correctly in the Share Chatbot UI.

Headers:

Preview:

Response:

I wanted to share this comparison in case it helps identify whether there was
a change in the public chatbot config response or in how the embed handles it
in v3.

I also tested on Microsoft Edge (Chromium) and observed the same behavior:
the request returns 200 OK with JSON headers, but DevTools cannot display the response body
(“Failed to load response data”).

[prd-hoang-doan]

Hi @meltemdanismaz ,
In version 3.0.12, there is a pull request to fix a CORS issue that causes the Flowise server reject external requests except for the public prediction API.

PR: https://github.com/FlowiseAI/Flowise/pull/5310/changes

It seems that you are running the self-hosted Flowise instance on your own host. In this case, you can fix the issue by updating the environment in your Flowise server (path: packages/server/.env), by default CORS_ORIGINS="" (reject all external requests)

CORS_ORIGINS=http://chatbot.local:3001,http://flowise.local:3000

The line of code to validate this issue:
https://github.com/FlowiseAI/Flowise/blob/main/packages/server/src/utils/XSS.ts#L47-L54

In my example:

• Running the Flowise instance on the host: http://flowise.local:3000
• Embedded chatbot in another server on the host: http://chatbot.local:3001

It's quite weird that Flowise accepts external requests for public chatbot prediction, but not the public chatbot config.

[HenryHengZJ]

thanks a lot @prd-hoang-doan for helping out!!