CSP Policy Blocks api.comfy.org When Using --disable-api-nodes

[comfy-pr-bot]

CSP Policy Blocks api.comfy.org When Using --disable-api-nodes

Description

When the backend server is started with the --disable-api-nodes flag, the Content Security Policy (CSP) header blocks all external API connections, including the required api.comfy.org endpoint that the frontend needs for node registry/search functionality.

Error

Content-Security-Policy: The page's settings blocked the loading of a resource (connect-src)
at https://api.comfy.org/nodes/search?search=&limit=64&page=1
because it violates the following directive: "connect-src 'self'"

Root Cause

The backend server implements a CSP middleware in server.py:186 that is activated when --disable-api-nodes is set:

response.headers['Content-Security-Policy'] = "... connect-src 'self'; ..."

This was added in PR #10829 to "force frontend offline" when API nodes are disabled. However, the CSP is too restrictive and blocks legitimate frontend functionality.

Impact

• ❌ Node search/registry features fail
• ❌ Cannot browse or install custom nodes from the frontend
• ❌ Analytics and error reporting may be blocked
• ❌ Authentication/payment popups may fail

Current CSP Policy

default-src 'self';
script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:;
style-src 'self' 'unsafe-inline';
img-src 'self' data: blob:;
font-src 'self';
connect-src 'self';         ← THIS IS THE PROBLEM
frame-src 'self';
object-src 'self';

Proposed Solution

Update the connect-src directive to allow the necessary external endpoints while maintaining security:

"connect-src 'self' https://api.comfy.org https://api.mixpanel.com https://*.mixpanel.com http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:* wss://*;"

Required External Domains

Frontend Dependencies:

• https://api.comfy.org - Node registry/search (CRITICAL)
• https://api.mixpanel.com - Analytics
• https://dreamboothy.firebaseapp.com - Authentication popups
• https://checkout.comfy.org - Payment flows
• Internal monitoring endpoints (as needed)

Local Development:

• http://localhost:*
• http://127.0.0.1:*
• WebSocket connections for dev servers

Alternative Solutions

1. Option A: Make CSP configurable via CLI argument

   --csp-allowlist "https://api.comfy.org https://other-domain.com"

2. Option B: Different CSP profiles for different use cases

   • --disable-api-nodes=strict - Current restrictive policy
   • --disable-api-nodes=standard - Allow frontend APIs (default)

3. Option C: Only block specific API node endpoints, not all external connections

Related Issues

• Backend PR --disable-api-nodes now sets CSP header to force frontend offline. #10829: Initial CSP implementation - "--disable-api-nodes now sets CSP header to force frontend offline"
• Backend Issue '--disable-api-nodes' completely breaks frontend #10922: "'--disable-api-nodes' completely breaks frontend"
• Backend PR Fix the CSP offline feature on latest frontend. #10923: "Fix the CSP offline feature"

Files Involved

Backend (comfyanonymous/ComfyUI):

• server.py:178-190 - CSP middleware
• server.py:223 - CSP activation

Frontend (this repo):

• src/config/comfyApi.ts - API endpoint configuration
• src/services/comfyRegistryService.ts - Registry service that needs api.comfy.org

Desktop App (Comfy-Org/electron):

• src/main-process/appWindow.ts - Window/popup handling

Additional Context

The --disable-api-nodes flag was designed to:

1. Disable backend API nodes (like Flux.1, etc.) ✅ Works
2. Force frontend offline via CSP ⚠️ Too aggressive

The CSP implementation conflicts with legitimate frontend features that require api.comfy.org access. A more nuanced approach is needed that distinguishes between:

• API nodes (backend computational nodes) - Should be blocked
• Frontend APIs (node registry, analytics, auth) - Should be allowed

Environment

• Branch: sno-csp (research branch)
• Affected: All deployments using --disable-api-nodes
• Severity: High - Breaks core frontend functionality

---

Full research report available: See attached report.md for comprehensive CSP analysis across all ComfyUI repositories.

┆Issue is synchronized with this Notion page by Unito

---

This issue is transferred from: Comfy-Org/ComfyUI_frontend#7823

Original issue was created by @snomiao at 2026-01-01T22:16:22.000Z

Original Comments:

@coderabbitai[bot]:

🔗 Related PRs
Comfy-Org/ComfyUI_frontend#6300 - style: update ui and design of system notification components (what's new, new release notification, help center)  [merged]

Comfy-Org/ComfyUI_frontend#6965 - fix: don't use registry when only checking for presence of missing nodes [merged]

Comfy-Org/ComfyUI_frontend#7337 - fix: improve type safety in type definitions [merged]

Comfy-Org/ComfyUI_frontend#7407 - make cloud onboarding survey disableable via runtime feature flag [merged]

Comfy-Org/ComfyUI_frontend#7596 - refactor: start on removing FF for subscription tiers [merged]


👤 Suggested Assignees

christian-byrne
Myestery
simula-r




Enable issue planning
To enable issue planning, add the following to your .coderabbit.yaml:
issue_enrichment:
  planning:
    enabled: true
You can then request a plan by commenting @coderabbitai plan on any issue.


 🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your .coderabbit.yaml:
issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

@snomiao:

## Updated Context: Extensions Need External API Access

The Core Problem
When --disable-api-nodes is enabled, the CSP policy blocks all external connections, including those needed by:

ComfyUI-Manager - Connects to api.comfy.org to search/install custom nodes
Partner Nodes - May connect to their own API endpoints for functionality
Custom Nodes - Can require various external APIs for features like:

Image generation services
Model downloading
API integrations
Analytics/telemetry



The Disconnect
Users disable API nodes to prevent backend computational API nodes (like Flux.1, DALL-E nodes, etc.) from running, but this shouldn't block:

❌ Frontend features (node registry, UI)
❌ Extension/custom node APIs (their legitimate external dependencies)
❌ Development tools (local WebSocket connections)

The current CSP doesn't distinguish between these use cases.
Updated Proposed Solutions
Option 1: Separate Backend API Node Blocking from Frontend CSP (Recommended)
Backend API nodes should be disabled at the execution layer, not via CSP:

Block API nodes from executing workflows
Allow frontend/extensions to make their own API calls
Let each extension manage its own external dependencies

# Remove CSP middleware when --disable-api-nodes is set
# Handle API node blocking in the execution engine instead
Pros:

✅ Doesn't break frontend features
✅ Doesn't break custom nodes/extensions
✅ Users get what they expect: API nodes don't run, but UI still works
✅ Extensions can still function normally

Cons:

Requires refactoring API node blocking logic


Option 2: Relaxed CSP with Common Extension Endpoints
Allow a baseline set of common extension APIs while blocking unknown origins:
"connect-src 'self' https://api.comfy.org https://*.comfy.org http://localhost:* http://127.0.0.1:* ws://* wss://*;"
Pros:

✅ Fixes immediate ComfyUI-Manager issue
✅ Supports local development
✅ Maintains some CSP protection

Cons:

⚠️ Still blocks custom nodes with unique API endpoints
⚠️ ws://* wss://* is very permissive


Option 3: CSP Allowlist via Configuration File
Allow extensions to declare their required API endpoints in a config file:
// custom_nodes/MyNode/api_allowlist.json
{
  "connect-src": [
    "https://my-service.com",
    "https://api.example.com"
  ]
}
ComfyUI aggregates these and builds the CSP dynamically.
Pros:

✅ Extensions explicitly declare dependencies
✅ More secure than wildcard allowlist
✅ Discoverable/auditable

Cons:

⚠️ Requires new API for extensions
⚠️ More complex implementation


Option 4: Disable CSP by Default, Enable via Opt-in Flag
# Current (broken):
python main.py --disable-api-nodes

# Proposed:
python main.py --disable-api-nodes                    # No CSP (default)
python main.py --disable-api-nodes --strict-offline   # Enable restrictive CSP
Pros:

✅ Doesn't break existing workflows
✅ Users who need strict offline can opt-in
✅ Simple to implement

Cons:

⚠️ Less secure by default


Option 5: Per-Environment CSP Profiles
--csp-profile=development   # Permissive (localhost, common APIs)
--csp-profile=production    # Balanced (api.comfy.org + essentials)
--csp-profile=strict        # Restrictive (current behavior)
Pros:

✅ Flexible for different use cases
✅ Clear naming

Cons:

⚠️ Users need to understand profiles


Recommended Approach
Option 1 (Separate concerns) is the cleanest solution:


Backend API node blocking → Handle in execution engine

Prevent API nodes from running in workflows
Don't affect frontend/extensions



CSP → Use for actual security (XSS protection), not feature gating

Implement sensible CSP for cloud deployments
Don't use CSP to block API nodes



This separates:

Security policy (CSP for XSS/injection protection)
Feature policy (which nodes can execute)

Impact on Extension Ecosystem
The current CSP breaks:

🔴 ComfyUI-Manager - Cannot search/install nodes
🔴 Any partner node with external APIs
🔴 Custom nodes that depend on external services
🔴 Development workflows (hot reload, debugging)

This significantly impacts the ComfyUI ecosystem where extensions are a core feature.

Would appreciate maintainer input on which approach aligns best with ComfyUI's architecture and security goals.

[LukeG89]

I don't know if the issue is related to --disable-api-nodes

I'm having this issue, but in my tests I didn't use that command arg:

• [Bug] New Manager (v4.0.3b5 -> v4.0.4) can't find custom nodes ComfyUI-Manager#2407

[snomiao]

it is related @LukeG89

[LukeG89]

it is related

@snomiao What could be the cause of my issue?

[comfyanonymous]

This is normal, people who don't want the api nodes also don't want any communication with the comfy servers.

[evaninf]

This is normal, people who don't want the api nodes also don't want any communication with the comfy servers.

I just spent 3 hours debugging the web browser thanks to this assumption.

People who don't want the API nodes don't want the API nodes, the rest is assuming user intention broader than what the flag clearly implies.

[fjallraven]

This is normal, people who don't want the api nodes also don't want any communication with the comfy servers.

I just spent 3 hours debugging the web browser thanks to this assumption.

People who don't want the API nodes don't want the API nodes, the rest is assuming user intention broader than what the flag clearly implies.

Same here...

Think it would be better to have a API_NODE=True base variable on node base class or similar and simply check on that.

[wallentri88]

This is not normal. It breaks @robertvoy ComfyUI Distributed nodes because current settings even forbid any localhost communication.

[VladiCz]

Unfortunately, current CSP settings affects localhost too (local lan on http and https on IP 192.168.1.X) as blob: and data: are not allows in media-src.
Drag-and-drop is not working for me in Brave/Chrome/Chromium browsers on Linux, which might be related.