I was really stumped, because ComfyUI-Manager kept reporting This action is not allowed with this security level configuration. but my security level was already set to weak by default (using YanWenKun/ComfyUI-Docker).
It turns out that ComfyUI-Manager will report this on any HTTP 403 for these kind of calls. Even if the 403 is not because of the security level. In my case I spent a long time messing with ComfyUI config files, versions, restarting, etc.
It turned out that ComfyUI itself will return a 403 on potentially modifying HTTP methods such as PATCH, POST, PUT – but not on GET, so things seem to work – when the Host header doesn't match the Origin header. Nothing was wrong with my ComfyUI set-up. I needed to forward the Host header in the reverse proxy that was running between my browser and ComfyUI.
It would be nice if ComfyUI-Manager would not return a false suggestion that it is because of the security level in these cases. However I'm not sure if ComfyUI-Manager can detect such cases.
At least I hope this will document the issue so it's easier to find for others.
I was really stumped, because ComfyUI-Manager kept reporting
This action is not allowed with this security level configuration.but my security level was already set toweakby default (using YanWenKun/ComfyUI-Docker).It turns out that ComfyUI-Manager will report this on any HTTP 403 for these kind of calls. Even if the 403 is not because of the security level. In my case I spent a long time messing with ComfyUI config files, versions, restarting, etc.
It turned out that ComfyUI itself will return a 403 on potentially modifying HTTP methods such as PATCH, POST, PUT – but not on GET, so things seem to work – when the Host header doesn't match the Origin header. Nothing was wrong with my ComfyUI set-up. I needed to forward the Host header in the reverse proxy that was running between my browser and ComfyUI.
It would be nice if ComfyUI-Manager would not return a false suggestion that it is because of the security level in these cases. However I'm not sure if ComfyUI-Manager can detect such cases.
At least I hope this will document the issue so it's easier to find for others.