I have the same issue with the file_uploader and tried many differend browser.serverAddress and browser.serverPort combinations, as well as setting an environment variable STREAMLIT_SERVER_COOKIE_SECRET with a string, like recommended in the docs.
Unfortunately, nothing has worked so far, except disabling XSRF protection.
I am also on a single instance deployment, so there should be no other server involved anyway.
This thread unfortunately never was continued, and I don’t know if/how to affect the cookie @ennui mentioned.