# AxiosError: Request failed with status code 403 when uploading a file with Streamlit

**URL:** <https://discuss.huggingface.co/t/axioserror-request-failed-with-status-code-403-when-uploading-a-file-with-streamlit/166694>\
**Category:** Beginners\
**Created:** [August 13, 2025, 12:56pm UTC](https://discuss.huggingface.co/t/axioserror-request-failed-with-status-code-403-when-uploading-a-file-with-streamlit/166694 "2025-08-13T12:56:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![HugoFTorres](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/hugoftorres/32/52535_2.png) [@HugoFTorres](https://discuss.huggingface.co/u/HugoFTorres)\
**Post date:** [August 13, 2025, 12:56pm UTC](https://discuss.huggingface.co/t/axioserror-request-failed-with-status-code-403-when-uploading-a-file-with-streamlit/166694/1 "2025-08-13T12:56:52Z")

</div>

I have been facing this error and even after checking similar discussions and adding `enableXsrfProtection false` to my `config.toml` file, I keep getting this. The upload bar fills up completely but it raises the error afterwards. In some discussions on Streamlit forums people also recommended adding `enableCORS = false` to the config, which I did but with no result. Tried it in incognito mode but also doesn’t work. Any idea on what might be causing this? If necessary I can provide the files to debug

---

<div class="post-metadata">

**Author:** ![John6666](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/john6666/32/27664_2.png) [@John6666](https://discuss.huggingface.co/u/John6666)\
**Post date:** [August 13, 2025, 3:17pm UTC](https://discuss.huggingface.co/t/axioserror-request-failed-with-status-code-403-when-uploading-a-file-with-streamlit/166694/2 "2025-08-13T15:17:44Z")

</div>

This issue has existed for quite some time, and there is no known solution. Existing workarounds also do not work.

I first asked the AI to summarize the workarounds currently known to address this issue. I will use this as a starting point to explore possible solutions.

* * *

Do these steps in order.

1. Confirm the cause

XSRF cookies are restricted inside the Spaces iframe. Streamlit’s uploader then rejects the final POST with 403. ([Hugging Face](https://huggingface.co/docs/hub/en/spaces-cookie-limitations "Cookie limitations in Spaces"))

1. Verify your app actually disabled XSRF

Add to your app and check on the deployed Space:

```python

import streamlit as st

st.write("XSRF:", st.get_option("server.enableXsrfProtection"))

```

It must show `False`. If it shows `True`, your config is not loaded. The config file must be at `.streamlit/config.toml` in the same working directory where `streamlit run` executes. ([Streamlit document](https://docs.streamlit.io/develop/api-reference/configuration/config.toml "config.toml - Streamlit Docs"))

1. If you use the Streamlit SDK Space (no Docker)

Create `.streamlit/config.toml`:

```toml

[server]

enableXsrfProtection = false

# optional if you test large files:

# maxUploadSize = 400

```

Redeploy, then re-check step 2. Max upload defaults to 200 MB; increase only if needed. ([Streamlit document](https://docs.streamlit.io/knowledge-base/deploy/increase-file-uploader-limit-streamlit-cloud "How do I increase the upload limit of st.file\_uploader on Streamlit Community Cloud?"))

1. If you use a Docker Space

Start Streamlit with flags so the setting is guaranteed:

```dockerfile

# Dockerfile (tail)

EXPOSE 8501

CMD streamlit run /app/app.py --server.port=8501 --server.address=0.0.0.0 --server.enableXsrfProtection=false

```

Spaces’ Streamlit guide shows the SDK and deployment pattern; running on 8501 is standard. ([Hugging Face](https://huggingface.co/docs/hub/en/spaces-sdks-streamlit "Streamlit Spaces - Hugging Face"))

1. Ignore `enableCORS` for this error

403 on upload is almost always XSRF, not CORS, when embedded or proxied. ([Streamlit](https://discuss.streamlit.io/t/file-uploader-403-error-when-embedding-streamlit-app-in-iframe/24109 "File Uploader: 403 error when embedding streamlit app in ..."))

1. Retest with a tiny file

This isolates XSRF from size issues. If large files fail only due to size, raise `server.maxUploadSize` as in step 3. ([Streamlit document](https://docs.streamlit.io/knowledge-base/deploy/increase-file-uploader-limit-streamlit-cloud "How do I increase the upload limit of st.file\_uploader on Streamlit Community Cloud?"))

1. If you’re behind auth or a reverse proxy

Azure AD and some proxies strip or alter the `_xsrf` cookie. Either keep XSRF off or ensure cookies pass through with proper attributes. ([GitHub](https://github.com/streamlit/streamlit/issues/5793 "Misconfigured \_xsrf cookies · Issue #5793 · streamlit/ ..."))

1. Version sanity check

If you’re on 1.30.x and still see 403 locally or elsewhere, upgrade to a newer Streamlit release; some users report 1.31.0+ resolved their 403. ([Streamlit](https://discuss.streamlit.io/t/file-upload-fails-with-axioserror-request-failed-with-status-code-403/60945 "File upload fails with AxiosError: Request failed with status ..."))

1. If the page was stale

A stale client cookie can mismatch after redeploys. Hard refresh after redeploys if you still see 403. ([Streamlit](https://discuss.streamlit.io/t/file-upload-fails-with-error-request-failed-with-status-code-403/27143?page=4 "File upload fails with Error: Request failed with status code ..."))

Copy-paste samples you can deploy:

A) SDK Space

```auto

# .streamlit/config.toml

[server]

enableXsrfProtection = false

```

```python

# app.py

import streamlit as st

st.write("XSRF:", st.get_option("server.enableXsrfProtection"))

f = st.file_uploader("Upload any file")

if f:

data = f.getvalue()

st.write({"name": f.name, "size_bytes": len(data)})

```

B) Docker Space

```dockerfile

FROM python:3.11-slim

RUN pip install --no-cache-dir streamlit==1.38.0

WORKDIR /app

COPY app.py /app/app.py

EXPOSE 8501

CMD streamlit run /app/app.py --server.port=8501 --server.address=0.0.0.0 --server.enableXsrfProtection=false

```

This sequence fixes the 403 in Spaces by ensuring XSRF is actually disabled and verified at runtime. ([Hugging Face](https://huggingface.co/docs/hub/en/spaces-cookie-limitations "Cookie limitations in Spaces"), [Streamlit document](https://docs.streamlit.io/develop/api-reference/configuration/config.toml "config.toml - Streamlit Docs"))

---

<div class="post-metadata">

**Author:** ![HugoFTorres](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/hugoftorres/32/52535_2.png) [@HugoFTorres](https://discuss.huggingface.co/u/HugoFTorres)\
**Post date:** [August 13, 2025, 3:29pm UTC](https://discuss.huggingface.co/t/axioserror-request-failed-with-status-code-403-when-uploading-a-file-with-streamlit/166694/3 "2025-08-13T15:29:47Z")

</div>

> [@John6666](#):
>

Adding it to the docker intialization solved the issue, seems like the config was not being read at all. Thanks!

---

<div class="post-metadata">

**Author:** ![John6666](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/john6666/32/27664_2.png) [@John6666](https://discuss.huggingface.co/u/John6666)\
**Post date:** [August 13, 2025, 3:30pm UTC](https://discuss.huggingface.co/t/axioserror-request-failed-with-status-code-403-when-uploading-a-file-with-streamlit/166694/4 "2025-08-13T15:30:40Z")

</div>

Great! Congrats.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/hellohellohello/original/2X/d/de4155eb4aa4108ecb32a1389d7cc37ae69f88b7.png) [@system](https://discuss.huggingface.co/u/system)\
**Post date:** [August 14, 2025, 3:31am UTC](https://discuss.huggingface.co/t/axioserror-request-failed-with-status-code-403-when-uploading-a-file-with-streamlit/166694/5 "2025-08-14T03:31:02Z")

</div>

This topic was automatically closed 12 hours after the last reply. New replies are no longer allowed.