Description

#5739 / #5780 fixed CSRF 403s on LLM Settings writes by (a) attaching X-CSRF-Token on every state-changing fetch and (b) not sending a malformed Authorization: Bearer header when getAuthToken() returns empty (session-cookie logins have no bearer token).

selectiveImport.js and fileTransfer.js build headers by hand the same way llmModels.js did before the fix, and were explicitly called out as out of scope in that PR. They have the same bug:

• mcpgateway/admin_ui/selectiveImport.js:288-298 — POST /admin/import/configuration
• mcpgateway/admin_ui/fileTransfer.js:342-352 — POST /admin/import/preview
• mcpgateway/admin_ui/fileTransfer.js:398-408 — POST /admin/import/configuration

All three build headers manually:

headers: {
  "Content-Type": "application/json",
  Authorization: `Bearer ${await getAuthToken()}`,
},

No X-CSRF-Token header is attached, and Authorization is set unconditionally — for session-cookie logins (getAuthToken() returns ""), this sends a malformed Bearer header instead of omitting the header as the fixed llmRequestHeaders() helper in llmModels.js:18-32 does.

Expected

Import/export writes under /admin/import/* should not 403 with CSRF validation failures under CSRF_ENABLED=true, matching the behavior restored for /admin/llm/* in #5780.

Suggested fix

Extract llmRequestHeaders() (or an equivalent shared helper) out of llmModels.js into utils.js and route selectiveImport.js / fileTransfer.js POST calls through it, same pattern as the #5780 fix.

Related

• [BUG]: Saving LLM Provider/Model in Admin UI fails with 403 CSRF validation failed #5739
• fix(admin-ui): fix CSRF failures on LLM Settings writes #5780