diff --git a/src/lightning_app/frontend/stream_lit.py b/src/lightning_app/frontend/stream_lit.py
index bc5ec21fb830c..e72248432441b 100644
--- a/src/lightning_app/frontend/stream_lit.py
+++ b/src/lightning_app/frontend/stream_lit.py
@@ -6,6 +6,7 @@
 
 import lightning_app
 from lightning_app.frontend.frontend import Frontend
+from lightning_app.utilities.cloud import is_running_in_cloud
 from lightning_app.utilities.imports import requires
 from lightning_app.utilities.log import get_logfile
 
@@ -83,6 +84,8 @@ def start_server(self, host: str, port: int) -> None:
                     self.flow.name,
                     "--server.headless",
                     "true",  # do not open the browser window when running locally
+                    "--server.enableXsrfProtection",
+                    "true" if is_running_in_cloud() else "false",
                 ],
                 env=env,
                 stdout=stdout,
diff --git a/tests/tests_app/frontend/test_stream_lit.py b/tests/tests_app/frontend/test_stream_lit.py
index cd3a394a89d75..1b3be42c0ae6f 100644
--- a/tests/tests_app/frontend/test_stream_lit.py
+++ b/tests/tests_app/frontend/test_stream_lit.py
@@ -54,6 +54,8 @@ def test_streamlit_frontend_start_stop_server(subprocess_mock):
         "root.my.flow",
         "--server.headless",
         "true",
+        "--server.enableXsrfProtection",
+        "false",
     ]
 
     assert env_variables["LIGHTNING_FLOW_NAME"] == "root.my.flow"