Comfy-Org / Comfy-Org/ComfyUI

Install queue fails to start when accessed through reverse proxy (CSRF check rejects valid requests)

Open
#14,456 2 comments 1 reaction 0 assignees View on GitHub
Potential Bug
Dominant language
Python
Stars
133k
Forks
15.7k
Avg merge
1d 7h
Merged PRs (30d)
158

Description

# Install queue fails to start when accessed through reverse proxy (CSRF check rejects valid requests)

## Description

The `/manager/queue/start` endpoint has a CSRF protection (`_reject_simple_form_content_type`) that rejects POST requests without a `Content-Type` header or with simple form content types. When ComfyUI is accessed through a reverse proxy (JupyterHub, nginx subpath, etc.), the browser's fetch request for this endpoint gets its `Content-Type` header stripped or altered by the proxy, causing a 400 response. As a result, clicking "Install" in the Manager UI adds items to the queue but the queue worker never starts.

## Steps to Reproduce

1. Run ComfyUI behind a reverse proxy (e.g., JupyterHub, nginx with subpath, Traefik)
2. Open ComfyUI Manager
3. Find a custom node or model to install
4. Click "Install"
5. Observe that the button appears to work but nothing actually downloads

## Expected Behavior

The install queue starts processing and the node/model is downloaded and installed.

## Actual Behavior

The item is added to the queue (`/manager/queue/install_model` succeeds) but the queue worker never starts because `/manager/queue/start` returns 400 due to the CSRF content-type check. The UI shows no error — it just silently does nothing.

Manually calling the endpoint from inside the container works:
```bash
curl -s -X POST http://127.0.0.1:8188/manager/queue/start -H 'Content-Type: application/json'
```

## Debug Logs

Browser Network tab:
```
POST /manager/queue/install_model → 200 (item queued successfully)
POST /manager/queue/start → 400 "Invalid Content-Type for this endpoint"
```

Server-side queue status confirms the issue:
```json
{"total_count": 1, "done_count": 0, "in_progress_count": 0, "is_processing": false}
```

## Root Cause

In `glob/manager_server.py`, the `queue_start` handler has:

```python
@routes.post("/manager/queue/start")
async def queue_start(request):
resp = _reject_simple_form_content_type(request)
if resp is not None:
return resp
```

The `_reject_simple_form_content_type` function rejects requests where `Content-Type` is not `application/json`. When the request passes through certain reverse proxies, the `Content-Type` header is stripped or modified since the request has no body, causing this check to fail.

## Suggested Fix

Option A: Have the frontend explicitly send `Content-Type: application/json` with an empty JSON body `{}` for this endpoint.

Option B: Remove the CSRF gate from `/manager/queue/start` since this endpoint already requires a prior successful call to `/manager/queue/install_model` (which does parse a JSON body and is thus already CSRF-protected).

Option C: Accept requests with no `Content-Type` header (only reject explicitly simple form types like `application/x-www-form-urlencoded` and `multipart/form-data`).

## Environment

- ComfyUI: latest master (commit 822aca19)
- ComfyUI-Manager: latest main (commit 194bcedc)
- comfyui-frontend-package: 1.45.15
- Python: 3.12
- Proxy: JupyterHub (nginx-based reverse proxy with subpath)
- Browser: Microsoft Edge 149
- OS: Ubuntu (container on Kubernetes)

## Other

This affects all endpoints gated by `_reject_simple_form_content_type` when accessed via reverse proxy:
- `/manager/queue/start`
- `/manager/queue/reinstall`
- `/snapshot/save`
- `/manager/reboot`

The issue does not occur when accessing ComfyUI directly on localhost without a proxy.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.