Merge pull request #562 from langflow-ai/model-get-calls

Fix security issue w/ get model calls

frontend/app/api/queries/useGetModelsQuery.ts

@@ -42,11 +42,18 @@ export const useGetOpenAIModelsQuery = (
 
   async function getOpenAIModels(): Promise<ModelsResponse> {
     const url = new URL("/api/models/openai", window.location.origin);
+    const body: { api_key?: string } = {};
     if (params?.apiKey) {
-      url.searchParams.set("api_key", params.apiKey);
+      body.api_key = params.apiKey;
     }
 
-    const response = await fetch(url.toString());
+    const response = await fetch(url.toString(), {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify(body),
+    });
     if (response.ok) {
       return await response.json();
     } else {
@@ -77,11 +84,18 @@ export const useGetAnthropicModelsQuery = (
 
   async function getAnthropicModels(): Promise<ModelsResponse> {
     const url = new URL("/api/models/anthropic", window.location.origin);
+    const body: { api_key?: string } = {};
     if (params?.apiKey) {
-      url.searchParams.set("api_key", params.apiKey);
+      body.api_key = params.apiKey;
     }
 
-    const response = await fetch(url.toString());
+    const response = await fetch(url.toString(), {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify(body),
+    });
     if (response.ok) {
       return await response.json();
     } else {
@@ -147,17 +161,28 @@ export const useGetIBMModelsQuery = (
 
   async function getIBMModels(): Promise<ModelsResponse> {
     const url = new URL("/api/models/ibm", window.location.origin);
+    const body: {
+      endpoint?: string;
+      api_key?: string;
+      project_id?: string;
+    } = {};
     if (params?.endpoint) {
-      url.searchParams.set("endpoint", params.endpoint);
+      body.endpoint = params.endpoint;
     }
     if (params?.apiKey) {
-      url.searchParams.set("api_key", params.apiKey);
+      body.api_key = params.apiKey;
     }
     if (params?.projectId) {
-      url.searchParams.set("project_id", params.projectId);
+      body.project_id = params.projectId;
     }
 
-    const response = await fetch(url.toString());
+    const response = await fetch(url.toString(), {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify(body),
+    });
     if (response.ok) {
       return await response.json();
     } else {

src/api/models.py

@@ -8,9 +8,14 @@ logger = get_logger(__name__)
 async def get_openai_models(request, models_service, session_manager):
     """Get available OpenAI models"""
     try:
-        # Get API key from query parameters
+        # Get API key from request body
-        query_params = dict(request.query_params)
+        api_key = None
-        api_key = query_params.get("api_key")
+        try:
+            body = await request.json()
+            api_key = body.get("api_key") if body else None
+        except Exception:
+            # Body might be empty or invalid JSON, continue to fallback
+            pass
 
         # If no API key provided, try to get it from stored configuration
         if not api_key:
@@ -26,7 +31,7 @@ async def get_openai_models(request, models_service, session_manager):
         if not api_key:
             return JSONResponse(
                 {
-                    "error": "OpenAI API key is required either as query parameter or in configuration"
+                    "error": "OpenAI API key is required either in request body or in configuration"
                 },
                 status_code=400,
             )
@@ -42,9 +47,14 @@ async def get_openai_models(request, models_service, session_manager):
 async def get_anthropic_models(request, models_service, session_manager):
     """Get available Anthropic models"""
     try:
-        # Get API key from query parameters
+        # Get API key from request body
-        query_params = dict(request.query_params)
+        api_key = None
-        api_key = query_params.get("api_key")
+        try:
+            body = await request.json()
+            api_key = body.get("api_key") if body else None
+        except Exception:
+            # Body might be empty or invalid JSON, continue to fallback
+            pass
 
         # If no API key provided, try to get it from stored configuration
         if not api_key:
@@ -60,7 +70,7 @@ async def get_anthropic_models(request, models_service, session_manager):
         if not api_key:
             return JSONResponse(
                 {
-                    "error": "Anthropic API key is required either as query parameter or in configuration"
+                    "error": "Anthropic API key is required either in request body or in configuration"
                 },
                 status_code=400,
             )
@@ -112,11 +122,19 @@ async def get_ollama_models(request, models_service, session_manager):
 async def get_ibm_models(request, models_service, session_manager):
     """Get available IBM Watson models"""
     try:
-        # Get parameters from query parameters if provided
+        # Get parameters from request body if provided
-        query_params = dict(request.query_params)
+        endpoint = None
-        endpoint = query_params.get("endpoint")
+        api_key = None
-        api_key = query_params.get("api_key")
+        project_id = None
-        project_id = query_params.get("project_id")
+        try:
+            body = await request.json()
+            if body:
+                endpoint = body.get("endpoint")
+                api_key = body.get("api_key")
+                project_id = body.get("project_id")
+        except Exception:
+            # Body might be empty or invalid JSON, continue to fallback
+            pass
 
         config = get_openrag_config()
         # If no API key provided, try to get it from stored configuration
@@ -132,7 +150,7 @@ async def get_ibm_models(request, models_service, session_manager):
         if not api_key:
             return JSONResponse(
                 {
-                    "error": "WatsonX API key is required either as query parameter or in configuration"
+                    "error": "WatsonX API key is required either in request body or in configuration"
                 },
                 status_code=400,
             )
@@ -149,7 +167,7 @@ async def get_ibm_models(request, models_service, session_manager):
         if not endpoint:
             return JSONResponse(
                 {
-                    "error": "Endpoint is required either as query parameter or in configuration"
+                    "error": "Endpoint is required either in request body or in configuration"
                 },
                 status_code=400,
             )
@@ -166,7 +184,7 @@ async def get_ibm_models(request, models_service, session_manager):
         if not project_id:
             return JSONResponse(
                 {
-                    "error": "Project ID is required either as query parameter or in configuration"
+                    "error": "Project ID is required either in request body or in configuration"
                 },
                 status_code=400,
             )

src/main.py

@@ -1105,7 +1105,7 @@ async def create_app():
                     session_manager=services["session_manager"],
                 )
             ),
-            methods=["GET"],
+            methods=["POST"],
         ),
         Route(
             "/models/anthropic",
@@ -1116,7 +1116,7 @@ async def create_app():
                     session_manager=services["session_manager"],
                 )
             ),
-            methods=["GET"],
+            methods=["POST"],
         ),
         Route(
             "/models/ollama",
@@ -1138,7 +1138,7 @@ async def create_app():
                     session_manager=services["session_manager"],
                 )
             ),
-            methods=["GET", "POST"],
+            methods=["POST"],
         ),
         # Onboarding endpoint
         Route(