File upload fails with Error: Request failed with status code 403

[emeister]

Hi all,

I’m a DevOps engineer working with AWS cloud, and I’m following a project where I need to deploy a Streamlit application on Internet through AWS.

We got the error: “Error: Request failed with status code 403” after uploading a file through the file_uploader. It turns out that the error was the Application Load Balancer in front of the server hosting Streamlit. The Application Load Balancer was protected by Web Application Firewall rules, and one of these blocks all the packets that has a body larger than 8 KB (typical of file upload). The name of the AWS WAF rule was SizeRestrictions_BODY.

By disabling this rule, everything worked fine. Don’t know if this can be helpful for whoever has issues in exposing Streamlit from cloud environments.

[Steve_White]

Hi, were you able to solve this issue? I have exactly the same problem, also when deploying to Azure, works fine locally.

Thanks!

[ennui]

Do you have anything between your app and the users on Azure?

Try turning off XSRF protection by adding:

[server]
enableXsrfProtection = false

to streamlit/config.toml, or --server.enableXsrfProtection=false to the run command. Note that this is not really a recommended long-term / production use; I figure I am safe enough just by having an AD authentication requirement and a small & trusted user pool.

Here are some other topics on the problem, including my own. I have not been able to get a satisfying solution yet:

Deployment on Azure + AD Authentication enabled + st.file_uploader = 403 Forbidden

Hi, I am attempting to deploy a Streamlit app on a production instance of Azure’s AppService. Deployment is done via a Docker image stored on a container registry. Everything works fine when authentication for the App is turned off. However, when I turn it on, the file uploader widget in my app stops working and throws this error: “Error: Request failed with status code 403”. The same issue was discussed here (Deployment on Azure (AppService) + AD Authentication enabled + st.file_uploader = 4…

Azure AD, XSRF protection and st.file_uploader

Like the author of this topic, I am trying to deploy my Streamlit app as a single container Azure Web App. I am running into the same problem with st.file_uploader returning a 403 error when Active Directory is used for authentication. I disabled XSRF protection as suggested here and that fixes the problem. However, I do not understand enough about Streamlit’s architecture to know whether this is a viable long-term solution. The next steps presented in the documentation page are somewhat crypti…

Deployment on Azure (AppService) + AD Authentication enabled + st.file_uploader = 403 Forbidden

Hello, I’m using a production workload of AppService so all issues with regards to sockets and getting stuck on ‘connecting…’ (described here: https://discuss.streamlit.io/t/azure-appservice-with-authentication-issues) are fine, app loads correctly. Deployment is on a linux docker image hosted on ACR (Azure Container Registry). However when a file gets uploaded into the st.file_uploader widget, the POST http request returns a 403 Forbidden. [image] When AD Authentication is disabled, file u…

File Uploader: 403 error when embedding streamlit app in iframe

I am trying to embed Streamlit app on my website. I embedded the app via iframe and it “mostly” works. The only component that doesn’t work is the file uploader. When uploading the file I get the following error: Request failed with status code 403 I got the same error even when creating empty .html locally and embedding localhost link from Streamlit. Guys, any ideas?

I have a low-confidence suspicion that this is caused by the _xsrf token not getting through. I opened up an issue here but I might be way off my base as webdev stuff is not my forte.

[AveryData]

Ugh just hit the same exact issue. Running locally in an conda environment

[Livia_Meinhardt]

Hi, I’m getting this error.
I’m getting this error when using the streamlit via IFRAME. It’s all local.

What can I do?