{"record":{"id":"1382307a8c0329dd","repo":"Comfy-Org/ComfyUI","slug":"unknown-user","errorCode":null,"errorMessage":"Unknown user: ","messagePattern":"Unknown user: ","errorType":"http","errorClass":"KeyError","httpStatus":null,"severity":"error","filePath":"app/user_manager.py","lineNumber":65,"sourceCode":"        if args.multi_user:\n            if os.path.isfile(self.get_users_file()):\n                with open(self.get_users_file()) as f:\n                    self.users = json.load(f)\n            else:\n                self.users = {}\n        else:\n            self.users = {\"default\": \"default\"}\n\n    def get_users_file(self):\n        return os.path.join(folder_paths.get_user_directory(), \"users.json\")\n\n    def get_request_user_id(self, request):\n        user = \"default\"\n        if args.multi_user and \"comfy-user\" in request.headers:\n            user = request.headers[\"comfy-user\"]\n            # Block System Users (use same error message to prevent probing)\n            if user.startswith(folder_paths.SYSTEM_USER_PREFIX):\n                raise KeyError(\"Unknown user: \" + user)\n\n        if user not in self.users:\n            raise KeyError(\"Unknown user: \" + user)\n\n        return user\n\n    def get_request_user_filepath(self, request, file, type=\"userdata\", create_dir=True):\n        if type == \"userdata\":\n            root_dir = folder_paths.get_user_directory()\n        else:\n            raise KeyError(\"Unknown filepath type:\" + type)\n\n        user = self.get_request_user_id(request)\n        user_root = folder_paths.get_public_user_directory(user)\n        if user_root is None:\n            return None\n        path = user_root\n","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/Comfy-Org/ComfyUI/blob/1c6d8d45b3693bfbb32385b410d813a7fd6be216/app/user_manager.py#L47-L83","documentation":"UserManager.get_request_user_id rejects any 'comfy-user' request header whose value starts with the reserved system prefix (folder_paths.SYSTEM_USER_PREFIX, '__'). The same generic 'Unknown user: <id>' KeyError is used both here and for unknown users on purpose, so callers cannot probe which IDs exist. System-prefixed directories are reserved for ComfyUI's own files (built-in workflows, etc.).","triggerScenarios":"Sending a request with header comfy-user: __foo while --multi-user is enabled; a client or custom node routing requests on behalf of a user id that begins with '__'.","commonSituations":"Custom frontends or scripts constructing user ids from file names; attempting to read/write another user's userdata by guessing reserved ids; a stale client holding a system user id returned by an older/other component.","solutions":["Send a normal user id in the comfy-user header — one created via the users API (it never starts with '__').","If you manage user records yourself, filter out ids starting with folder_paths.SYSTEM_USER_PREFIX before issuing requests.","Verify --multi-user is actually intended; without it the header is ignored and 'default' is used."],"exampleFix":"# before\nheaders = {\"comfy-user\": \"__built_in\"}\nrequests.get(url, headers=headers)\n\n# after\nheaders = {\"comfy-user\": \"a1b2c3d4-...\"}  # real id from users.json\nrequests.get(url, headers=headers)","handlingStrategy":"validation","validationCode":"import folder_paths\nuser = request.headers.get(\"comfy-user\", \"default\")\nif user.startswith(folder_paths.SYSTEM_USER_PREFIX):\n    raise HTTPException(400, \"Unknown user\")  # reject before calling user manager","typeGuard":"import folder_paths\ndef is_valid_user_id(user_id: str) -> bool:\n    return not user_id.startswith(folder_paths.SYSTEM_USER_PREFIX)","tryCatchPattern":"try:\n    uid = user_manager.get_request_user_id(request)\nexcept KeyError as e:\n    return web.Response(status=400, text=str(e))  # do not distinguish probe vs unknown","preventionTips":["Only use ids issued by the user-creation API.","Filter out system-prefixed ('__') ids in client code before sending headers."],"tags":["auth","multi-user","api","security"],"backgroundTag":null,"analyzedSha":"1c6d8d45b3693bfbb32385b410d813a7fd6be216","analyzedAt":"2026-08-14T19:37:18.893Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}