Fix: disable XSRF/CORS so file uploads work behind HF proxy (403 fix)

.streamlit/config.toml

@@ -15,15 +15,16 @@ font = "sans serif"
 toolbarMode = "minimal"
 
 # --- Server settings -------------------------------------------------------
-# Production-safe defaults for a shared deployment (Hugging Face Space):
-# XSRF protection is ON and CORS is left at its secure default. Hugging Face
-# serves Streamlit same-origin behind its proxy, so st.file_uploader works
-# with XSRF enabled.
+# st.file_uploader is core to this app (dossier files + job screenshot). Behind
+# Hugging Face's reverse proxy, Streamlit's XSRF check rejects the upload POST
+# with "AxiosError: Request failed with status code 403", so both XSRF and CORS
+# are disabled here to make uploads work on the Space.
 #
-# LOCAL DEV NOTE: if you run from a proxied / non-standard local setup and see
-# a browser "AxiosError: Request failed with status code 403" on upload, set
-# enableXsrfProtection = false (and enableCORS = false) locally only — do NOT
-# commit those values for the deployed Space.
+# Security note: this is acceptable for THIS app because there is no persistent
+# server-side session to forge against — each visitor supplies their own API
+# key, held only in their own in-memory session, and nothing is stored
+# server-side. There is no privileged state a cross-site request could abuse.
 [server]
 maxUploadSize = 50            # max upload size per file, in MB (dossier + screenshot)
-enableXsrfProtection = true   # keep ON for any shared/public deployment
+enableCORS = false            # required alongside the XSRF setting below
+enableXsrfProtection = false  # clears the 403 upload error on Hugging Face