Skip to content

--disable-api-nodes now sets CSP header to force frontend offline. #10829

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
comfyanonymous merged 2 commits into from
Nov 21, 2025
Merged

--disable-api-nodes now sets CSP header to force frontend offline. #10829

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0534b54
--disable-api-nodes now sets CSP header to force frontend offline.
comfyanonymous Nov 21, 2025
4a0fb37
Fix
comfyanonymous Nov 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion comfy/cli_args.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,7 @@ class PerformanceFeature(enum.Enum):
parser.add_argument("--disable-metadata", action="store_true", help="Disable saving prompt metadata in files.")
parser.add_argument("--disable-all-custom-nodes", action="store_true", help="Disable loading all custom nodes.")
parser.add_argument("--whitelist-custom-nodes", type=str, nargs='+', default=[], help="Specify custom node folders to load even when --disable-all-custom-nodes is enabled.")
parser.add_argument("--disable-api-nodes", action="store_true", help="Disable loading all api nodes.")
parser.add_argument("--disable-api-nodes", action="store_true", help="Disable loading all api nodes. Also prevents the frontend from communicating with the internet.")

parser.add_argument("--multi-user", action="store_true", help="Enables per-user storage.")

Expand Down
19 changes: 19 additions & 0 deletions server.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,22 @@ async def origin_only_middleware(request: web.Request, handler):

return origin_only_middleware


def create_block_external_middleware():
@web.middleware
async def block_external_middleware(request: web.Request, handler):
if request.method == "OPTIONS":
# Pre-flight request. Reply successfully:
response = web.Response()
else:
response = await handler(request)

response.headers['Content-Security-Policy'] = "default-src 'self'; script-src 'self' 'unsafe-inline' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-src 'self'; object-src 'self';"
return response

return block_external_middleware


class PromptServer():
def __init__(self, loop):
PromptServer.instance = self
Expand Down Expand Up @@ -193,6 +209,9 @@ def __init__(self, loop):
else:
middlewares.append(create_origin_only_middleware())

if args.disable_api_nodes:
middlewares.append(create_block_external_middleware())

max_upload_size = round(args.max_upload_size * 1024 * 1024)
self.app = web.Application(client_max_size=max_upload_size, middlewares=middlewares)
self.sockets = dict()
Expand Down