{"record":{"id":"a8970ae80826e3cb","repo":"AUTOMATIC1111/stable-diffusion-webui","slug":"requests-not-allowed","errorCode":null,"errorMessage":"Requests not allowed","messagePattern":"Requests not allowed","errorType":"http","errorClass":"HTTPException","httpStatus":500,"severity":"error","filePath":"modules/api/api.py","lineNumber":80,"sourceCode":"    from urllib.parse import urlparse\n    try:\n        parsed_url = urlparse(url)\n        domain_name = parsed_url.netloc\n        host = socket.gethostbyname_ex(domain_name)\n        for ip in host[2]:\n            ip_addr = ipaddress.ip_address(ip)\n            if not ip_addr.is_global:\n                return False\n    except Exception:\n        return False\n\n    return True\n\n\ndef decode_base64_to_image(encoding):\n    if encoding.startswith(\"http://\") or encoding.startswith(\"https://\"):\n        if not opts.api_enable_requests:\n            raise HTTPException(status_code=500, detail=\"Requests not allowed\")\n\n        if opts.api_forbid_local_requests and not verify_url(encoding):\n            raise HTTPException(status_code=500, detail=\"Request to local resource not allowed\")\n\n        headers = {'user-agent': opts.api_useragent} if opts.api_useragent else {}\n        response = requests.get(encoding, timeout=30, headers=headers)\n        try:\n            image = images.read(BytesIO(response.content))\n            return image\n        except Exception as e:\n            raise HTTPException(status_code=500, detail=\"Invalid image url\") from e\n\n    if encoding.startswith(\"data:image/\"):\n        encoding = encoding.split(\";\")[1].split(\",\")[1]\n    try:\n        image = images.read(BytesIO(base64.b64decode(encoding)))\n        return image\n    except Exception as e:","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/82a973c04367123ae98bd9abdf80d9eda9b910e2/modules/api/api.py#L62-L98","documentation":"HTTP 500 raised by decode_base64_to_image when the 'init_images'/'image' payload is an http:// or https:// URL but the server option api_enable_requests is disabled (default). The API refuses to perform outbound HTTP fetches on the client's behalf unless the operator explicitly opts in, because remote fetching is an SSRF vector.","triggerScenarios":"POST /sdapi/v1/img2img with init_images=['https://example.com/img.png'], or /sdapi/v1/interrogate with image='http://.../a.jpg', while Settings -> API -> 'Allow inputs via HTTP request' (api_enable_requests) is unchecked or not set via --api-enable-requests.","commonSituations":"API clients ported from tools that accepted URLs directly; headless pipelines passing image URLs to save bandwidth; servers where the option was never enabled after an upgrade that introduced the flag.","solutions":["Enable the setting: launch flag --api-enable-requests, or in the UI Settings -> API -> enable 'Allow inputs via HTTP request', then restart","Better: fetch the image client-side and send base64 (or a data: URI) instead of a URL","If self-hosting both sides, consider serving the image as base64 through your own proxy rather than enabling server-side fetches"],"exampleFix":"# before\nrequests.post(url+'/sdapi/v1/img2img', json={'init_images':['https://cdn.example.com/a.png']})\n\n# after\nimport base64, requests\nb64 = base64.b64encode(requests.get('https://cdn.example.com/a.png').content).decode()\nrequests.post(url+'/sdapi/v1/img2img', json={'init_images':[b64]})","handlingStrategy":"validation","validationCode":"opts = requests.get(f'{base}/sdapi/v1/options', auth=auth).json()\nif any(str(x).startswith(('http://','https://')) for x in payload.get('init_images',[])) and not opts.get('api_enable_requests'):\n    # convert URLs to base64 client-side instead\n    payload['init_images'] = [b64_from_url(x) for x in payload['init_images']]","typeGuard":"def is_url_image(s: str) -> bool:\n    return isinstance(s, str) and s.startswith(('http://','https://'))","tryCatchPattern":"resp = requests.post(img2img_url, json=payload, auth=auth)\nif resp.status_code == 500 and resp.json()['detail'] == 'Requests not allowed':\n    payload['init_images'] = [b64_from_url(u) for u in payload['init_images']]\n    resp = requests.post(img2img_url, json=payload, auth=auth)","preventionTips":["Default to sending base64, not URLs","If URLs are required, enable api_enable_requests deliberately and pair it with api_forbid_local_requests","Document that URL inputs are opt-in on the server"],"tags":["api","security","ssrf","http-500","stable-diffusion-webui"],"backgroundTag":null,"analyzedSha":"82a973c04367123ae98bd9abdf80d9eda9b910e2","analyzedAt":"2026-08-14T16:46:43.225Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}