From 8d45321c9b237d5e298d116dc536fb9ca76ef05e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 22 Feb 2026 21:18:55 +0000
Subject: [PATCH 1/3] Initial plan


From 29e059cb7591a1dae73870a47319f2d00e39f16f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 22 Feb 2026 21:24:24 +0000
Subject: [PATCH 2/3] fix(ui): add X-CSRF-Token header to XHR file upload
 requests

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 frontend/static/js/upload.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/frontend/static/js/upload.js b/frontend/static/js/upload.js
index 91a29f6d..1cb92074 100644
--- a/frontend/static/js/upload.js
+++ b/frontend/static/js/upload.js
@@ -140,6 +140,12 @@ async function uploadFile(file, progressBar, statusEl, statusMessage) {
     const xhr = new XMLHttpRequest();
     xhr.open("POST", "/api/ui-upload", true);
 
+    // Attach CSRF token so the server-side CSRF middleware accepts the request.
+    const csrfToken = typeof getCsrfToken === 'function' ? getCsrfToken() : '';
+    if (csrfToken) {
+      xhr.setRequestHeader("X-CSRF-Token", csrfToken);
+    }
+
     xhr.upload.onprogress = (e) => {
       if (e.lengthComputable) {
         const percentComplete = (e.loaded / e.total) * 100;

From a9dcdb7a0d51fa7a7bd2a4154b694385615fc4a1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 22 Feb 2026 21:37:22 +0000
Subject: [PATCH 3/3] fix(ui): add X-CSRF-Token header to retry fetch calls in
 file_detail.html

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 frontend/templates/file_detail.html | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/frontend/templates/file_detail.html b/frontend/templates/file_detail.html
index 97c681e9..fefd1af4 100644
--- a/frontend/templates/file_detail.html
+++ b/frontend/templates/file_detail.html
@@ -599,7 +599,8 @@
         const response = await fetch(`/api/files/${fileId}/reprocess`, {
           method: 'POST',
           headers: {
-            'Content-Type': 'application/json'
+            'Content-Type': 'application/json',
+            'X-CSRF-Token': getCsrfToken()
           }
         });
 
@@ -651,7 +652,8 @@
         const response = await fetch(`/api/files/${fileId}/retry-subtask?subtask_name=${subtaskName}`, {
           method: 'POST',
           headers: {
-            'Content-Type': 'application/json'
+            'Content-Type': 'application/json',
+            'X-CSRF-Token': getCsrfToken()
           }
         });