Update src/streamlit_app.py

src/streamlit_app.py

@@ -22,6 +22,20 @@ try:
 except Exception as e:
     print(f"[startup] WARNING: could not create {streamlit_dir}: {e}")
 
+# HF Spaces serves the app behind an iframe/proxy, which makes Streamlit's
+# default XSRF Origin check reject the file-uploader's POST with 403 even
+# though the websocket connection works fine. Disable it via config.toml.
+_config_toml = streamlit_dir / "config.toml"
+try:
+    if not _config_toml.exists():
+        _config_toml.write_text(
+            "[server]\nenableXsrfProtection = false\nenableCORS = false\n",
+            encoding="utf-8",
+        )
+        print(f"[startup] wrote {_config_toml}")
+except Exception as e:
+    print(f"[startup] WARNING: could not write {_config_toml}: {e}")
+
 # -----------------------------
 # Imports
 # -----------------------------