How to Configure CORS Settings to Allow Cross-Origin Requests in Private-GPT

Enable cross-origin requests in Private-GPT by setting server.cors.enabled to true in your YAML configuration file and defining the allowed origins, methods, and headers under the server.cors section.

Private-GPT, the open-source project for document interaction using local LLMs, exposes a FastAPI-based HTTP API that requires explicit CORS configuration for browser-based clients. To configure CORS settings to allow cross-origin requests, you must modify the Pydantic-based settings in your environment-specific YAML file, which the application loads at startup to initialize the FastAPI middleware stack.

Where CORS Is Implemented in the Source Code

The CORS middleware integration lives in two critical files within the zylon-ai/private-gpt repository. In private_gpt/settings/settings.py, the CorsSettings Pydantic model (lines 16-55) defines the configuration schema with fields for enabled, allow_origins, allow_origin_regex, allow_methods, allow_headers, and allow_credentials.

The actual middleware injection occurs in private_gpt/launcher.py within the create_app function (lines 45-56). According to the source code, the application checks settings.server.cors.enabled and, if true, calls app.add_middleware(CORSMiddleware, …) with the values defined in the CorsSettings model.

Step-by-Step CORS Configuration

1. Locate Your Environment Configuration File

Private-GPT uses YAML files for runtime configuration. Depending on your deployment target, edit settings.yaml, settings-local.yaml, or settings-docker.yaml. The server.cors section in these files directly maps to the CorsSettings model.

2. Configure the CORS Parameters

Add or modify the cors block under server. The following table lists the configurable fields defined in private_gpt/settings/settings.py:

• enabled: Boolean flag to activate CORS middleware (default: false)
• allow_origins: List of permitted origins (e.g., ["https://app.example.com"])
• allow_origin_regex: Regular expression pattern for dynamic origin matching (default: null)
• allow_methods: HTTP methods allowed (default: ["GET"])
• allow_headers: Request headers permitted (e.g., ["Authorization", "Content-Type"])
• allow_credentials: Boolean to permit cookies and authentication headers (default: false)

3. Apply Changes and Restart

After saving your YAML file, restart the Private-GPT server. The FastAPI application will instantiate CORSMiddleware with your specified parameters, injecting the appropriate Access-Control-Allow-Origin and related headers into HTTP responses.

CORS Configuration Examples

Local Development Environment

For frontend development on localhost:3000, configure settings-local.yaml as follows:

server:
  env_name: local
  port: 8001
  cors:
    enabled: true
    allow_credentials: false
    allow_origins:
      - "http://localhost:3000"
      - "http://127.0.0.1:3000"
    allow_methods:
      - "GET"
      - "POST"
      - "OPTIONS"
    allow_headers:
      - "*"

Production Deployment

For a secured production frontend, use settings-docker.yaml or settings.yaml:

server:
  env_name: prod
  port: 8001
  cors:
    enabled: true
    allow_credentials: true
    allow_origins:
      - "https://app.mycompany.com"
    allow_methods:
      - "GET"
      - "POST"
      - "PUT"
      - "DELETE"
      - "OPTIONS"
    allow_headers:
      - "Authorization"
      - "Content-Type"

Summary

• Private-GPT implements CORS through FastAPI's CORSMiddleware, conditionally added in private_gpt/launcher.py (lines 45-56).
• The CorsSettings Pydantic model in private_gpt/settings/settings.py (lines 16-55) defines all configurable fields including allow_origins and allow_origin_regex.
• Set server.cors.enabled to true in your YAML configuration to activate cross-origin support.
• Define explicit origins with allow_origins or use regex patterns with allow_origin_regex for dynamic subdomain matching.
• Always restart the server after modifying CORS settings to reload the middleware with new parameters.

Frequently Asked Questions

How do I enable CORS for all origins in Private-GPT?

Set allow_origins to ["*"] in your configuration file. This setting permits any origin to access the API, but should only be used in local development environments due to security implications.

Why am I still seeing CORS errors after enabling the settings?

Verify that you restarted the server after saving the YAML file. Also ensure the origin URL in your browser request exactly matches the entries in allow_origins, including the protocol (https vs http) and any port numbers.

Can I use regex patterns instead of listing specific origins?

Yes. Use the allow_origin_regex field to define a pattern such as "^https://.*\\.example\\.com$" to match multiple subdomains dynamically. This parameter is processed by the CORSMiddleware initialization in private_gpt/launcher.py.

Do I need to enable allow_credentials for API key authentication?

If your cross-origin requests include the Authorization header or cookies, set allow_credentials to true and explicitly list your origins (wildcard origins are not permitted when credentials are enabled). Ensure Authorization is included in the allow_headers list.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}