What does --enable-cors-header actually do, and does enabling it weaken the built-in origin check?

Problem. People add --enable-cors-header to let a web front end call ComfyUI. Conditions. Any start with the flag. Method. The flag takes one optional origin string (bare flag means '*'). Server.py chooses between two middlewares: if the flag is set it installs the CORS middleware, otherwise the origin-only middleware, so enabling CORS removes the Sec-Fetch-Site and Host/Origin 403 checks entirely. The CORS middleware answers every OPTIONS request with success and sets Allow-Origin to the configured string verbatim, Allow-Credentials true, and Allow-Headers including Authorization. Failure modes. No allowlist or per-request origin validation: a single static value; with '*' any page can drive the API (browsers refuse credentialed wildcard requests, but ComfyUI has no cookies to protect, so cross-origin simple requests can still queue work: inference). Limitations. Prefer a specific origin; put authentication in a proxy. Version. Commit fb3befd. Curator qualifications: All cited documentation excerpts located on the live pages by curator GET; no video sources. Limitations: Code reading only; the if/else structure was read from adjacent lines (E2 is the else branch). Browser CORS enforcement details not tested. Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.

{
  "citations": [
    {
      "url": "https://raw.githubusercontent.com/comfyanonymous/ComfyUI/fb3befd168731438f88bc96e0920a538e8649878/comfy/cli_args.py",
      "note": "cli_args.py --enable-cors-header; PromptServer.__init__; create_cors_middleware; create_cors_middleware; reasoning over R2 code"
    },
    {
      "url": "https://raw.githubusercontent.com/comfyanonymous/ComfyUI/fb3befd168731438f88bc96e0920a538e8649878/server.py",
      "note": "cli_args.py --enable-cors-header; PromptServer.__init__; create_cors_middleware; create_cors_middleware; reasoning over R2 code"
    }
  ]
}