Production Security Warning - Genai Toolbox

⚠️ Production Security Warning

Secure your deployment: By default, Toolbox uses HTTP and runs on all hosts (--allowed-hosts) and all origins (--allowed-origins). While convenient, this is insecure and could expose you to unauthorized access of your toolbox instances. Please review the example under reference/cli to secure your instances.

Note: The server issues a warning in the logs if these are set to the wildcard *.

Prevent DNS Rebinding: Use the --allowed-hosts flag to specify a list of hosts for validation. Example: command: ["--config", "/config/tools.yaml", "--address", "0.0.0.0", "--allowed-hosts", "localhost:5000"]
Implement CORS: Use the --allowed-origins flag to specify a list of origins permitted to access the server. Example: command: ["--config", "/config/tools.yaml", "--address", "0.0.0.0", "--allowed-origins", "https://foo.bar"]
Enable HTTPS: Use the --tls-cert and --tls-key flags to secure your connection. Example: command: ["--config", "/config/tools.yaml", "--address", "0.0.0.0", "--tls-cert", "cert.pem", "--tls-key", "key.pem"]