diff --git a/front/maintenance.php b/front/maintenance.php
index 7a3d2b247..fcbdb24d9 100755
--- a/front/maintenance.php
+++ b/front/maintenance.php
@@ -508,7 +508,7 @@ function UploadConfig()
   appConfBase64 = btoa(appConf)
 
   // import
-  $.post('php/server/query_replace_config.php', { base64data: appConfBase64, fileName: "app.conf" }, function(msg) {
+  $.post('php/server/query_replace_config.php', { base64data: appConfBase64, fileName: "app.conf", csrf_token: <?= json_encode(getCsrfToken()) ?> }, function(msg) {
     console.log(msg);
     // showMessage(msg);
     write_notification(`[Maintenance]: ${msg}`, 'interrupt');
diff --git a/front/php/server/query_replace_config.php b/front/php/server/query_replace_config.php
index deb930b46..3a191467c 100755
--- a/front/php/server/query_replace_config.php
+++ b/front/php/server/query_replace_config.php
@@ -17,6 +17,8 @@ global $configFolderPath;
 // Handle incoming requests
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
 
+    requireCsrfToken();
+
     $base64Data = $_POST['base64data'] ?? null;
     if (!$base64Data) {
         http_response_code(400);
diff --git a/front/workflowsCore.php b/front/workflowsCore.php
index b5a4516b2..eb8866244 100755
--- a/front/workflowsCore.php
+++ b/front/workflowsCore.php
@@ -1231,7 +1231,7 @@ function saveWorkflows()
   appConfBase64 = btoa(JSON.stringify(getWorkflowsJson()))
 
   // import
-  $.post('php/server/query_replace_config.php', { base64data: appConfBase64, fileName: "workflows.json" })
+  $.post('php/server/query_replace_config.php', { base64data: appConfBase64, fileName: "workflows.json", csrf_token: <?= json_encode(getCsrfToken()) ?> })
     .done(function(msg) {
       console.log(msg);
       write_notification(`[WF]: ${msg}`, 'interrupt');