[GH-ISSUE #2453] Wrong suggestion on unrelated 403 #975

New issue

Open

opened 2026-10-27 21:24:40 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-27 21:24:40 +00:00

Owner

Originally created by @Ghostbird on GitHub (Jan 1, 2026).
Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/2453

I was really stumped, because ComfyUI-Manager kept reporting This action is not allowed with this security level configuration. but my security level was already set to weak by default (using YanWenKun/ComfyUI-Docker).

It turns out that ComfyUI-Manager will report this on any HTTP 403 for these kind of calls. Even if the 403 is not because of the security level. In my case I spent a long time messing with ComfyUI config files, versions, restarting, etc.

It turned out that ComfyUI itself will return a 403 on potentially modifying HTTP methods such as PATCH, POST, PUT – but not on GET, so things seem to work – when the Host header doesn't match the Origin header. Nothing was wrong with my ComfyUI set-up. I needed to forward the Host header in the reverse proxy that was running between my browser and ComfyUI.

It would be nice if ComfyUI-Manager would not return a false suggestion that it is because of the security level in these cases. However I'm not sure if ComfyUI-Manager can detect such cases.

At least I hope this will document the issue so it's easier to find for others.

Originally created by @Ghostbird on GitHub (Jan 1, 2026). Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/2453 I was really stumped, because ComfyUI-Manager kept reporting `This action is not allowed with this security level configuration.` but my security level was already set to `weak` by default (using YanWenKun/ComfyUI-Docker). It turns out that ComfyUI-Manager will report this on any HTTP 403 for these kind of calls. Even if the 403 is not because of the security level. In my case I spent a long time messing with ComfyUI config files, versions, restarting, etc. It turned out that ComfyUI itself will return a 403 on _potentially modifying_ HTTP methods such as PATCH, POST, PUT – but not on GET, so things seem to work – when the Host header doesn't match the Origin header. Nothing was wrong with my ComfyUI set-up. I needed to forward the Host header in the reverse proxy that was running between my browser and ComfyUI. It would be nice if ComfyUI-Manager would not return a false suggestion that it is because of the security level in these cases. However I'm not sure if ComfyUI-Manager _can_ detect such cases. At least I hope this will document the issue so it's easier to find for others.