biondizzle/vllm
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

[Small] Prevent bypassing media domain restriction via HTTP redirects (#26035)

Browse Source 
Signed-off-by: Chenheli Hua <huachenheli@outlook.com>
Signed-off-by: simon-mo <simon.mo@hey.com>
This commit is contained in:
Chenheli Hua
2025-10-02 10:27:10 -07:00
committed by simon-mo
parent 6040e0b6c0
commit 9d9a2b77f1
5 changed files with 39 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
docs/usage/security.md
View File

@@ -66,6 +66,9 @@ Restrict domains that vLLM can access for media URLs by setting
`--allowed-media-domains` to prevent Server-Side Request Forgery (SSRF) attacks.
(e.g. `--allowed-media-domains upload.wikimedia.org github.com www.bogotobogo.com`)
Also, consider setting `VLLM_MEDIA_URL_ALLOW_REDIRECTS=0` to prevent HTTP
redirects from being followed to bypass domain restrictions.
## Security and Firewalls: Protecting Exposed vLLM Systems
While vLLM is designed to allow unsafe network services to be isolated to