Skip to content

Unauthorized runSSE requests when XSRF protection enabled #459

Description

@caigwatkin

Behaviour

Requests to POST /run_sse from the ADK web UI fail with HTTP status 401 Unauthorized if the ADK API has XSRF protection enabled.

From my observation, this only affects the SSE request; other requests such as create session do succeed.

Root cause

X-XSRF-TOKEN header not added to /run_sse fetch request.

Note: Other requests succeed because they use HttpClient from '@angular/common/http' which automatically enables XSRF protection (see withNoXsrfProtection). The SSE request uses fetch, I guess because it needs to stream the SSE response body.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions