AUTOMATIC1111/stable-diffusion-webui · error · HTTPException

Requests not allowed

Error message

Requests not allowed

What it means

HTTP 500 raised by decode_base64_to_image when the 'init_images'/'image' payload is an http:// or https:// URL but the server option api_enable_requests is disabled (default). The API refuses to perform outbound HTTP fetches on the client's behalf unless the operator explicitly opts in, because remote fetching is an SSRF vector.

Source

Thrown at modules/api/api.py:80

    from urllib.parse import urlparse
    try:
        parsed_url = urlparse(url)
        domain_name = parsed_url.netloc
        host = socket.gethostbyname_ex(domain_name)
        for ip in host[2]:
            ip_addr = ipaddress.ip_address(ip)
            if not ip_addr.is_global:
                return False
    except Exception:
        return False

    return True


def decode_base64_to_image(encoding):
    if encoding.startswith("http://") or encoding.startswith("https://"):
        if not opts.api_enable_requests:
            raise HTTPException(status_code=500, detail="Requests not allowed")

        if opts.api_forbid_local_requests and not verify_url(encoding):
            raise HTTPException(status_code=500, detail="Request to local resource not allowed")

        headers = {'user-agent': opts.api_useragent} if opts.api_useragent else {}
        response = requests.get(encoding, timeout=30, headers=headers)
        try:
            image = images.read(BytesIO(response.content))
            return image
        except Exception as e:
            raise HTTPException(status_code=500, detail="Invalid image url") from e

    if encoding.startswith("data:image/"):
        encoding = encoding.split(";")[1].split(",")[1]
    try:
        image = images.read(BytesIO(base64.b64decode(encoding)))
        return image
    except Exception as e:

View on GitHub (pinned to 82a973c043)

Solutions

  1. Enable the setting: launch flag --api-enable-requests, or in the UI Settings -> API -> enable 'Allow inputs via HTTP request', then restart
  2. Better: fetch the image client-side and send base64 (or a data: URI) instead of a URL
  3. If self-hosting both sides, consider serving the image as base64 through your own proxy rather than enabling server-side fetches

Example fix

# before
requests.post(url+'/sdapi/v1/img2img', json={'init_images':['https://cdn.example.com/a.png']})

# after
import base64, requests
b64 = base64.b64encode(requests.get('https://cdn.example.com/a.png').content).decode()
requests.post(url+'/sdapi/v1/img2img', json={'init_images':[b64]})
Defensive patterns

Strategy: validation

Validate before calling

opts = requests.get(f'{base}/sdapi/v1/options', auth=auth).json()
if any(str(x).startswith(('http://','https://')) for x in payload.get('init_images',[])) and not opts.get('api_enable_requests'):
    # convert URLs to base64 client-side instead
    payload['init_images'] = [b64_from_url(x) for x in payload['init_images']]

Type guard

def is_url_image(s: str) -> bool:
    return isinstance(s, str) and s.startswith(('http://','https://'))

Try / catch

resp = requests.post(img2img_url, json=payload, auth=auth)
if resp.status_code == 500 and resp.json()['detail'] == 'Requests not allowed':
    payload['init_images'] = [b64_from_url(u) for u in payload['init_images']]
    resp = requests.post(img2img_url, json=payload, auth=auth)

Prevention

When it happens

Trigger: POST /sdapi/v1/img2img with init_images=['https://example.com/img.png'], or /sdapi/v1/interrogate with image='http://.../a.jpg', while Settings -> API -> 'Allow inputs via HTTP request' (api_enable_requests) is unchecked or not set via --api-enable-requests.

Common situations: API clients ported from tools that accepted URLs directly; headless pipelines passing image URLs to save bandwidth; servers where the option was never enabled after an upgrade that introduced the flag.

Related errors

AI-assisted analysis of AUTOMATIC1111/stable-diffusion-webui@82a973c043 (2026-08-14). Data as JSON: /api/errors/a8970ae80826e3cb. Report an issue: GitHub.