AUTOMATIC1111/stable-diffusion-webui · error · HTTPException

Request to local resource not allowed

Error message

Request to local resource not allowed

What it means

HTTP 500 raised by decode_base64_to_image when URL inputs are allowed (api_enable_requests on) but api_forbid_local_requests is also enabled and verify_url() resolved the URL to a non-global (private/loopback/link-local) IP or DNS resolution failed (the except path also returns False). It is the SSRF mitigation that stops API clients from making the server fetch http://169.254.169.254/, http://localhost/..., 10.x, 192.168.x, etc.

Source

Thrown at modules/api/api.py:83

        domain_name = parsed_url.netloc
        host = socket.gethostbyname_ex(domain_name)
        for ip in host[2]:
            ip_addr = ipaddress.ip_address(ip)
            if not ip_addr.is_global:
                return False
    except Exception:
        return False

    return True


def decode_base64_to_image(encoding):
    if encoding.startswith("http://") or encoding.startswith("https://"):
        if not opts.api_enable_requests:
            raise HTTPException(status_code=500, detail="Requests not allowed")

        if opts.api_forbid_local_requests and not verify_url(encoding):
            raise HTTPException(status_code=500, detail="Request to local resource not allowed")

        headers = {'user-agent': opts.api_useragent} if opts.api_useragent else {}
        response = requests.get(encoding, timeout=30, headers=headers)
        try:
            image = images.read(BytesIO(response.content))
            return image
        except Exception as e:
            raise HTTPException(status_code=500, detail="Invalid image url") from e

    if encoding.startswith("data:image/"):
        encoding = encoding.split(";")[1].split(",")[1]
    try:
        image = images.read(BytesIO(base64.b64decode(encoding)))
        return image
    except Exception as e:
        raise HTTPException(status_code=500, detail="Invalid encoded image") from e

View on GitHub (pinned to 82a973c043)

Solutions

  1. Serve the image from a globally reachable URL, or send the bytes as base64/data URI instead
  2. If this is deliberate and trusted (single-user LAN setup), disable Settings -> API -> 'Forbid inputs pointing to local resources' (api_forbid_local_requests)
  3. Ensure the URL's DNS resolves publicly; a resolution failure is treated the same as a local address

Example fix

# before (server-side fetch of LAN resource)
json={'init_images':['http://192.168.1.10:9000/photo.png']}

# after
b64 = base64.b64encode(open('photo.png','rb').read()).decode()
json={'init_images':[b64]}
Defensive patterns

Strategy: validation

Validate before calling

import ipaddress, socket
from urllib.parse import urlparse
def url_is_public(u: str) -> bool:
    try:
        host = urlparse(u).hostname
        ip = ipaddress.ip_address(socket.gethostbyname(host))
        return ip.is_global
    except Exception:
        return False
# before sending a URL payload when forbid_local is on:
if opts.get('api_forbid_local_requests') and not all(url_is_public(u) for u in urls):
    payload['init_images'] = [b64_from_url(u) for u in urls]

Type guard

def is_safe_remote_url(u: str) -> bool:
    return url_is_public(u)

Try / catch

if resp.status_code == 500 and 'local resource' in resp.json()['detail']:
    payload['init_images'] = [b64_from_url(u) for u in payload['init_images']]
    resp = requests.post(url, json=payload, auth=auth)

Prevention

When it happens

Trigger: img2img or interrogate request with image URL pointing at localhost, 127.0.0.1, a private LAN address, a .local hostname, or a domain whose DNS fails to resolve (any exception in ip_address/resolution counts as not verified); requires api_enable_requests=true and api_forbid_local_requests=true on the server.

Common situations: Docker deployments where the client references the container's own or sibling service by internal hostname; clients pointing at localhost image servers; hostnames that intermittently fail DNS, which the except swallows into 'not allowed'.

Related errors

AI-assisted analysis of AUTOMATIC1111/stable-diffusion-webui@82a973c043 (2026-08-14). Data as JSON: /api/errors/8db9e273c8907399. Report an issue: GitHub.