'--disable-api-nodes' completely breaks frontend #10922
Description
Custom Node Testing
- I have tried disabling custom nodes and the issue persists (see how to disable custom nodes if you need help)
Expected Behavior
ComfyUI frontend webpage should load correctly without errors
Actual Behavior
ComfyUI frontend loads as blank white page with error messages in the console (see below)
Steps to Reproduce
- Set the flag
--disable-api-nodes - Start ComfyUI
- See blank white page
Debug Logs
ComfyUI console (no errors, unrelated warnings)
import pynvml # type: ignore[import]
Checkpoint files will always be loaded safely.
Total VRAM 12282 MB, total RAM 32600 MB
pytorch version: 2.9.1+cu130
Set vram state to: NORMAL_VRAM
Device: cuda:0 NVIDIA GeForce RTX 4070 : cudaMallocAsync
Using async weight offloading with 2 streams
Enabled pinned memory 14669.0
working around nvidia conv3d memory bug.
Using sage attention
Python version: 3.12.6 (tags/v3.12.6:a4a2d2b, Sep 6 2024, 20:11:23) [MSC v.1940 64 bit (AMD64)]
ComfyUI version: 0.3.75
Initializing frontend: Comfy-Org/ComfyUI_frontend@latest, requesting version details from GitHub...
[Prompt Server] web root: f:\prog\comfy\ComfyUI\web_custom_versions\Comfy-Org_ComfyUI_frontend\1.34.0
F:\prog\comfy\ComfyUI\.venv\Lib\site-packages\pydantic\_internal\_fields.py:132: UserWarning: Field "model_url" in Model has conflict with protected namespace "model_".
You may be able to resolve this warning by setting `model_config['protected_namespaces'] = ()`.
warnings.warn(
F:\prog\comfy\ComfyUI\.venv\Lib\site-packages\kornia\feature\lightglue.py:44: FutureWarning: `torch.cuda.amp.custom_fwd(args...)` is deprecated. Please use `torch.amp.custom_fwd(args..., device_type='cuda')` instead.
@torch.cuda.amp.custom_fwd(cast_inputs=torch.float32)
Total VRAM 12282 MB, total RAM 32600 MB
pytorch version: 2.9.1+cu130
Set vram state to: NORMAL_VRAM
Device: cuda:0 NVIDIA GeForce RTX 4070 : cudaMallocAsync
Using async weight offloading with 2 streams
Enabled pinned memory 14669.0
Skipping loading of custom nodes
Context impl SQLiteImpl.
Will assume non-transactional DDL.
No target revision found.
Starting server
To see the GUI go to: http://127.0.0.1:8188
DevTools console
Hash of blocked script: "eval-sha256-umGz04RMfhXQRV0UXuuR6rWbzYb1SrHqWl1knfMsSxQ=".
(anonymous) @ index.js:5
core-base.mjs:1104 Hash of blocked script: "eval-sha256-qsVDjokZrHCoEhpe8XmJJ8qoK91np8XQD3bFE93kb60=".
compileToFunction @ core-base.mjs:1104
core-base.mjs:1104 Uncaught EvalError: Evaluating a string as JavaScript violates the following Content Security Policy directive because neither 'unsafe-eval' nor the string's hash are an allowed source of script: script-src 'self' 'unsafe-inline' blob:".
at new Function (<anonymous>)
at compileToFunction (core-base.mjs:1104:21)
at compileMessageFormat (core-base.mjs:1398:17)
at translate (core-base.mjs:1242:11)
at vue-i18n.mjs:564:48
at wrapWithDeps (vue-i18n.mjs:509:19)
at t (vue-i18n.mjs:564:16)
at signInSchema.ts:9:29
Other
- I'm using latest development heads on both BE and FE
- I believe the problematic change is the CSP header that blocks some loading scripts, added here: --disable-api-nodes now sets CSP header to force frontend offline. #10829
- Not sure if the problem is easier to solve here or on FE side, lmk I can repost Issue there 👍
Thanks in advance for having a look!