aladac/tensors
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow CORS preflight OPTIONS requests without auth

Browse Source 
CORS preflight requests don't send cookies, so they were failing auth.
Now OPTIONS requests are allowed through without authentication.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Adam Ladachowski
2026-02-15 23:38:23 +01:00
parent d589957cf1
commit 7caed3bbea
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tensors/server/comfyui_routes.py
+7 -2
View File
@@ -237,16 +237,21 @@ async def logout() -> Response:
return response return response
def _check_auth(comfy_session: str | None, path: str = "") -> None: def _check_auth(comfy_session: str | None, path: str = "", method: str = "GET") -> None:
"""Check if user is authenticated, raise redirect if not. """Check if user is authenticated, raise redirect if not.
Static assets (JS, CSS, fonts, images) are allowed without auth Static assets (JS, CSS, fonts, images) are allowed without auth
because modulepreload/crossorigin requests don't send cookies. because modulepreload/crossorigin requests don't send cookies.
OPTIONS requests (CORS preflight) are also allowed without auth.
""" """
if not COMFYUI_USER: if not COMFYUI_USER:
# Auth not configured, allow access # Auth not configured, allow access
return return
# Allow CORS preflight requests (they don't send cookies)
if method == "OPTIONS":
return
# Allow static assets without auth (modulepreload doesn't send cookies) # Allow static assets without auth (modulepreload doesn't send cookies)
static_extensions = {".js", ".css", ".woff", ".woff2", ".ttf", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".ico", ".json"} static_extensions = {".js", ".css", ".woff", ".woff2", ".ttf", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".ico", ".json"}
if any(path.lower().endswith(ext) for ext in static_extensions): if any(path.lower().endswith(ext) for ext in static_extensions):
@@ -262,7 +267,7 @@ def _check_auth(comfy_session: str | None, path: str = "") -> None:
@router.api_route("/comfy/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"]) @router.api_route("/comfy/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"])
async def proxy_comfyui(request: Request, path: str, comfy_session: str | None = Cookie(default=None)) -> Response: async def proxy_comfyui(request: Request, path: str, comfy_session: str | None = Cookie(default=None)) -> Response:
"""Proxy all HTTP requests to ComfyUI.""" """Proxy all HTTP requests to ComfyUI."""
_check_auth(comfy_session, path) _check_auth(comfy_session, path, request.method)
# Build target URL # Build target URL
target_url = f"{COMFYUI_URL}/{path}" target_url = f"{COMFYUI_URL}/{path}"