update_comfyui crashes on legacy UI after CSRF gate (regression in 4.2.1, #2819)

[kusayuzayushko]

Custom Node Testing

• I have tried disabling custom nodes and the issue persists (see how to disable custom nodes if you need help)

Expected Behavior

Clicking "Update ComfyUI" in the legacy Manager UI queues a ComfyUI update and returns HTTP 200, same as it did in 4.2.0 and earlier. No exception in the server log.

Actual Behavior

Clicking "Update ComfyUI" in the legacy Manager UI does nothing visible in the browser, and the server logs an unhandled AttributeError: 'NoneType' object has no attribute 'content_type' from comfyui_manager/common/manager_security.py:65. The update is never queued. A 500 response is returned to the client.

Steps to Reproduce

1. Install ComfyUI with comfyui-manager==4.2.1 (current PyPI release; pulled in by manager_requirements.txt).
2. Start ComfyUI with both flags: python main.py --enable-manager --enable-manager-legacy-ui.
3. Open the web UI in a browser and switch to / open the legacy Manager menu.
4. Click the Update ComfyUI button.
5. Observe: the button does nothing in the UI, and the server logs the AttributeError: 'NoneType' object has no attribute 'content_type' traceback shown in the Actual Behavior section.

No workflow JSON is needed — the bug is in the manager's HTTP handler, not in graph execution. It reproduces on a fresh ComfyUI install with no custom nodes loaded.

Debug Logs

[START] Security scan
[ComfyUI-Manager] Using uv as Python module for pip operations.
[DONE] Security scan
** ComfyUI startup time: 2026-04-27 10:01:38.118
** Platform: Linux
** Python version: 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0]
** Python executable: /usr/bin/python3
** ComfyUI Path: /app/ComfyUI
** ComfyUI Base Folder Path: /app/ComfyUI
** User directory: /app/ComfyUI/user
** ComfyUI-Manager config path: /app/ComfyUI/user/__manager/config.ini
** Log path: /app/ComfyUI/user/comfyui.log
[PRE] ComfyUI-Manager
Found comfy_kitchen backend eager: {'available': True, 'disabled': False, 'unavailable_reason': None, 'capabilities': ['apply_rope', 'apply_rope1', 'dequantize_mxfp8', 'dequantize_nvfp4', 'dequantize_per_tensor_fp8', 'quantize_mxfp8', 'quantize_nvfp4', 'quantize_per_tensor_fp8', 'scaled_mm_mxfp8', 'scaled_mm_nvfp4']}
Found comfy_kitchen backend cuda: {'available': True, 'disabled': False, 'unavailable_reason': None, 'capabilities': ['apply_rope', 'apply_rope1', 'dequantize_nvfp4', 'dequantize_per_tensor_fp8', 'quantize_mxfp8', 'quantize_nvfp4', 'quantize_per_tensor_fp8', 'scaled_mm_nvfp4']}
Found comfy_kitchen backend triton: {'available': True, 'disabled': True, 'unavailable_reason': None, 'capabilities': ['apply_rope', 'apply_rope1', 'dequantize_nvfp4', 'dequantize_per_tensor_fp8', 'quantize_mxfp8', 'quantize_nvfp4', 'quantize_per_tensor_fp8']}
Checkpoint files will always be loaded safely.
Total VRAM 24081 MB, total RAM 129024 MB
pytorch version: 2.13.0.dev20260422+cu130
Set vram state to: NORMAL_VRAM
Device: cuda:0 NVIDIA GeForce RTX 4090 : cudaMallocAsync
Using async weight offloading with 2 streams
Enabled pinned memory 116121.0
Using pytorch attention
DynamicVRAM support detected and enabled
Python version: 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0]
ComfyUI version: 0.19.3
comfy-aimdo version: 0.2.14
comfy-kitchen version: 0.2.8
ComfyUI frontend version: 1.42.14
[Prompt Server] web root: /usr/local/lib/python3.12/dist-packages/comfyui_frontend_package/static
Asset seeder disabled
[START] ComfyUI-Manager
[ComfyUI-Manager] Using GitPython backend
### Loading: ComfyUI-Manager (V4.2.1)
[ComfyUI-Manager] network_mode: personal_cloud
### ComfyUI Version: v0.19.3-37-g443074ee | Released on '2026-04-23'
[ComfyUI-Manager] Legacy UI is enabled.
[ComfyUI-Manager] default cache updated: https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/custom-node-list.json
[ComfyUI-Manager] default cache updated: https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/alter-list.json
[ComfyUI-Manager] default cache updated: https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/github-stats.json
[ComfyUI-Manager] default cache updated: https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/model-list.json
[ComfyUI-Manager] default cache updated: https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/extension-node-map.json
Skipping loading of custom nodes
Context impl SQLiteImpl.
Will assume non-transactional DDL.
Context impl SQLiteImpl.
Will assume non-transactional DDL.
Running upgrade  -> 0001_assets, Initial assets schema
Revision ID: 0001_assets
Revises: None
Create Date: 2025-12-10 00:00:00
Running upgrade 0001_assets -> 0002_merge_to_asset_references, Merge AssetInfo and AssetCacheState into unified asset_references table.
Running upgrade 0002_merge_to_asset_references -> 0003_add_metadata_job_id, Add system_metadata and job_id columns to asset_references.
Change preview_id FK from assets.id to asset_references.id.
Database upgraded from None to 0003_add_metadata_job_id
Starting server

To see the GUI go to: http://0.0.0.0:8188
To see the GUI go to: http://[::]:8188
[DEPRECATION WARNING] Detected import of deprecated legacy API: /scripts/ui.js. This is likely caused by a custom node extension using outdated APIs. Please update your extensions or contact the extension author for an updated version.
[DEPRECATION WARNING] Detected import of deprecated legacy API: /scripts/ui/components/buttonGroup.js. This is likely caused by a custom node extension using outdated APIs. Please update your extensions or contact the extension author for an updated version.
[DEPRECATION WARNING] Detected import of deprecated legacy API: /scripts/ui/components/button.js. This is likely caused by a custom node extension using outdated APIs. Please update your extensions or contact the extension author for an updated version.
FETCH ComfyRegistry Data [DONE]
[ComfyUI-Manager] default cache updated: https://api.comfy.org/nodes
FETCH DATA from: /usr/local/lib/python3.12/dist-packages/comfyui_manager/custom-node-list.json [DONE]
[ComfyUI-Manager] All startup tasks have been completed.
Error handling request from 198.105.124.138
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/dist-packages/aiohttp/web_protocol.py", line 517, in _handle_request
    resp = await request_handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/aiohttp/web_app.py", line 569, in _handle
    return await handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/aiohttp/web_middlewares.py", line 117, in impl
    return await handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/app/ComfyUI/middleware/cache_middleware.py", line 27, in cache_control
    response: web.Response = await handler(request)
                             ^^^^^^^^^^^^^^^^^^^^^^
  File "/app/ComfyUI/server.py", line 86, in deprecation_warning
    response: web.Response = await handler(request)
                             ^^^^^^^^^^^^^^^^^^^^^^
  File "/app/ComfyUI/server.py", line 180, in origin_only_middleware
    response = await handler(request)
               ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/comfyui_manager/__init__.py", line 128, in manager_middleware
    response: web.Response = await handler(request)
                             ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/comfyui_manager/legacy/manager_server.py", line 787, in queue_batch
    await update_comfyui(None)
  File "/usr/local/lib/python3.12/dist-packages/comfyui_manager/legacy/manager_server.py", line 1600, in update_comfyui
    rejection = manager_security.reject_simple_form_post(request)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/comfyui_manager/common/manager_security.py", line 65, in reject_simple_form_post
    if request.content_type in _SIMPLE_FORM_CONTENT_TYPES:
       ^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'content_type'

Other

Update All obviously affected as well