Wrong suggestion on unrelated 403

I was really stumped, because ComfyUI-Manager kept reporting `This action is not allowed with this security level configuration.` but my security level was already set to `weak` by default (using YanWenKun/ComfyUI-Docker).

It turns out that ComfyUI-Manager will report this on any HTTP 403 for these kind of calls. Even if the 403 is not because of the security level. In my case I spent a long time messing with ComfyUI config files, versions, restarting, etc.

It turned out that ComfyUI itself will return a 403 on _potentially modifying_ HTTP methods such as PATCH, POST, PUT – but not on GET, so things seem to work – when the Host header doesn't match the Origin header. Nothing was wrong with my ComfyUI set-up. I needed to forward the Host header in the reverse proxy that was running between my browser and ComfyUI.

It would be nice if ComfyUI-Manager would not return a false suggestion that it is because of the security level in these cases. However I'm not sure if ComfyUI-Manager _can_ detect such cases.

At least I hope this will document the issue so it's easier to find for others.

Start by locating the HTTP 403 handling that produces the security-level message, then reproduce a modifying request with mismatched Host and Origin headers. Done means an unrelated 403 no longer suggests changing the security level, while genuine security-level failures retain the appropriate message.

Written by the indexing model from the issue text.