Behaviour
Requests to POST /run_sse from the ADK web UI fail with HTTP status 401 Unauthorized if the ADK API has XSRF protection enabled.
From my observation, this only affects the SSE request; other requests such as create session do succeed.
Root cause
X-XSRF-TOKEN header not added to /run_sse fetch request.
Note: Other requests succeed because they use HttpClient from '@angular/common/http' which automatically enables XSRF protection (see withNoXsrfProtection). The SSE request uses fetch, I guess because it needs to stream the SSE response body.
Behaviour
Requests to
POST /run_ssefrom the ADK web UI fail with HTTP status 401 Unauthorized if the ADK API has XSRF protection enabled.From my observation, this only affects the SSE request; other requests such as create session do succeed.
Root cause
X-XSRF-TOKENheader not added to/run_ssefetch request.Note: Other requests succeed because they use
HttpClientfrom'@angular/common/http'which automatically enables XSRF protection (see withNoXsrfProtection). The SSE request usesfetch, I guess because it needs to stream the SSE response body.