← fix library

CRITICAL LangServe: LangServe chain API exposed without authentication

Why it matters

LangServe publishes your LangChain/LangGraph runnable over HTTP with a playground UI. Without auth, anyone can open /playground or call /invoke and run your chain against your models, tools, and data.

Fix it — 3 steps

1. Put LangServe behind an authenticating reverse proxy with TLS, or enable the framework's auth dependencies before binding to a public interface.
2. Disable the playground in production (`disabled_endpoints=["playground"]`) if you do not need it; keep /docs off the public internet.
3. Bind to 127.0.0.1 for local-only use and block the port: `sudo ufw deny <port>`.

Verify it’s fixed

curl -sS http://YOUR_SERVER_IP:8000/openapi.json  # strangers should not see /invoke or /playground paths

References

• https://github.com/langchain-ai/langserve
• https://python.langchain.com/docs/langserve/