Install queue fails to start when accessed through reverse proxy (CSRF check rejects valid requests)
- Dominant language
- Python
- Stars
- 133k
- Forks
- 15.7k
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 158
Description
# Install queue fails to start when accessed through reverse proxy (CSRF check rejects valid requests)
## Description
The `/manager/queue/start` endpoint has a CSRF protection (`_reject_simple_form_content_type`) that rejects POST requests without a `Content-Type` header or with simple form content types. When ComfyUI is accessed through a reverse proxy (JupyterHub, nginx subpath, etc.), the browser's fetch request for this endpoint gets its `Content-Type` header stripped or altered by the proxy, causing a 400 response. As a result, clicking "Install" in the Manager UI adds items to the queue but the queue worker never starts.
## Steps to Reproduce
1. Run ComfyUI behind a reverse proxy (e.g., JupyterHub, nginx with subpath, Traefik)
2. Open ComfyUI Manager
3. Find a custom node or model to install
4. Click "Install"
5. Observe that the button appears to work but nothing actually downloads
## Expected Behavior
The install queue starts processing and the node/model is downloaded and installed.
## Actual Behavior
The item is added to the queue (`/manager/queue/install_model` succeeds) but the queue worker never starts because `/manager/queue/start` returns 400 due to the CSRF content-type check. The UI shows no error — it just silently does nothing.
Manually calling the endpoint from inside the container works:
```bash
curl -s -X POST http://127.0.0.1:8188/manager/queue/start -H 'Content-Type: application/json'
```
## Debug Logs
Browser Network tab:
```
POST /manager/queue/install_model → 200 (item queued successfully)
POST /manager/queue/start → 400 "Invalid Content-Type for this endpoint"
```
Server-side queue status confirms the issue:
```json
{"total_count": 1, "done_count": 0, "in_progress_count": 0, "is_processing": false}
```
## Root Cause
In `glob/manager_server.py`, the `queue_start` handler has:
```python
@routes.post("/manager/queue/start")
async def queue_start(request):
resp = _reject_simple_form_content_type(request)
if resp is not None:
return resp
```
The `_reject_simple_form_content_type` function rejects requests where `Content-Type` is not `application/json`. When the request passes through certain reverse proxies, the `Content-Type` header is stripped or modified since the request has no body, causing this check to fail.
## Suggested Fix
Option A: Have the frontend explicitly send `Content-Type: application/json` with an empty JSON body `{}` for this endpoint.
Option B: Remove the CSRF gate from `/manager/queue/start` since this endpoint already requires a prior successful call to `/manager/queue/install_model` (which does parse a JSON body and is thus already CSRF-protected).
Option C: Accept requests with no `Content-Type` header (only reject explicitly simple form types like `application/x-www-form-urlencoded` and `multipart/form-data`).
## Environment
- ComfyUI: latest master (commit 822aca19)
- ComfyUI-Manager: latest main (commit 194bcedc)
- comfyui-frontend-package: 1.45.15
- Python: 3.12
- Proxy: JupyterHub (nginx-based reverse proxy with subpath)
- Browser: Microsoft Edge 149
- OS: Ubuntu (container on Kubernetes)
## Other
This affects all endpoints gated by `_reject_simple_form_content_type` when accessed via reverse proxy:
- `/manager/queue/start`
- `/manager/queue/reinstall`
- `/snapshot/save`
- `/manager/reboot`
The issue does not occur when accessing ComfyUI directly on localhost without a proxy.
Contributor guide
Assessment
This issue has not been assessed yet.