Disable XSRF/CORS so file uploads work behind HF proxy

.streamlit/config.toml

@@ -1,7 +1,9 @@
 [server]
 headless = true
+# CORS/XSRF are disabled because the app runs behind Hugging Face's proxy/iframe,
+# which blocks the XSRF cookie and makes file uploads fail with AxiosError(403).
 enableCORS = false
-enableXsrfProtection = true
+enableXsrfProtection = false
 maxUploadSize = 25
 
 [browser]

Dockerfile

@@ -33,4 +33,4 @@ COPY --chown=user . .
 EXPOSE 7860
 
 # HF Spaces expects the app on the port declared as app_port in README.md (7860).
-CMD ["sh", "-c", "streamlit run core/app.py --server.port=${PORT:-7860} --server.address=0.0.0.0"]
+CMD ["sh", "-c", "streamlit run core/app.py --server.port=${PORT:-7860} --server.address=0.0.0.0 --server.enableCORS=false --server.enableXsrfProtection=false"]