HTTP 变量 (浏览器缓存)

The problem this node solves is the one every API-calling workflow hits: your API key. Put a key in a normal ComfyUI string widget and it gets baked into the workflow JSON, which means it's in your saved files, your PNG metadata, and any workflow you share. This node is the pack's answer - a variable container whose contents are stored in your browser's localStorage instead of the workflow, so sharing a workflow never shares your secrets.

How it works

Mechanically it's sneaky and simple. The node has a single required input, json_data, which defaults to "{}" - and the pack's JavaScript hides that field and manages it for you. The frontend reads and writes a localStorage key (zml_http_browser_vars) and stores your variables as a JSON object there, per-browser. At execution the backend just does json.loads(json_data) and hands the dict to whatever consumes the HTTP_VARS output. The "workflow" never contains your key - the workflow contains a placeholder that the JS fills from your browser at runtime.

That's the same pattern the author uses for the pack's LLM nodes: keys stored in browser cache, shared workflows stay clean. It's a genuinely good call, and it matches the KB's security guidance that a credential baked into a node is exactly the thing that ends up leaking.

The inputs

• json_data - hidden, auto-filled by the JS. You don't touch it; it exists so the value can travel to the backend.

Output: 安全变量包 ("safe variable pack"), type HTTP_VARS, which feeds the vars_browser socket on ZML_HTTP_Request.

Installing

Same pack:

cd ComfyUI/custom_nodes
git clone https://github.com/zml-w/ComfyUI-ZML-Image

restart, or ComfyUI Manager. No extra dependencies. Translation patch at https://github.com/zml-w/ZZZ_ZML_English_Patch.

Common issues

The trade-offs are the ones that come with "in the browser." First, the variables are per-browser and per-machine - open the same workflow on another machine and the key isn't there, which is the point (secrets don't travel) but also a real annoyance if you sync workflows across setups. Second, localStorage survives page reloads but is cleared with your browser data; a wiped profile means re-entering keys. Third - and this is the one that bites - if the JS hasn't run for you yet (fresh install, aggressive ad-blocker, or the frontend file being stale), json_data stays "{}" and your request goes out with zero variables, which reads as a mysteriously empty body. Check that the field got filled before debugging the endpoint. And keep the workflow variable node (ZML_HTTP_Vars_Workflow) for non-secret values - browser storage is for keys, workflow storage is for everything else.