zlei6/ComfyUI
1
0
Fork 0
mirror of https://github.com/Comfy-Org/ComfyUI.git synced 2026-08-24 01:56:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

Allow cross-site UI navigation

Browse Source 
Amp-Thread-ID: https://ampcode.com/threads/T-019ff807-a342-7628-863e-847d1dad3d5d
Co-authored-by: Amp <amp@ampcode.com>
This commit is contained in:
Jedrzej Kosinski
2026-08-12 15:59:23 -07:00
parent d00f56388d
commit f8d63fb01f
2 changed files with 125 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
middleware/origin_middleware.py
View File

@@ -35,9 +35,14 @@ def is_loopback(host):
def create_origin_only_middleware():
@web.middleware
async def origin_only_middleware(request: web.Request, handler):
if 'Sec-Fetch-Site' in request.headers:
sec_fetch_site = request.headers['Sec-Fetch-Site']
if sec_fetch_site == 'cross-site':
if request.headers.get('Sec-Fetch-Site') == 'cross-site':
is_top_level_navigation = (
request.method == 'GET'
and request.path == '/'
and request.headers.get('Sec-Fetch-Mode') == 'navigate'
and request.headers.get('Sec-Fetch-Dest') == 'document'
)
if not is_top_level_navigation:
return web.Response(status=403)
#this code is used to prevent the case where a random website can queue comfy workflows by making a POST to 127.0.0.1 which browsers don't prevent for some dumb reason.
#in that case the Host and Origin hostnames won't match