Quoting myself from 182134:

If wgMFPhotoUploadEndpoint isn't set, then you can't upload a photo locally.

When wgMFPhotoUploadEndpoint isn't set, the PhotoApi#save uses mw.Api.post (not postWithToken) to upload the photo and the upload API action requires a CSRF token.

ForeignApi is a useful abstraction but it isn't interchangeable with mw.Api in this situation.

and

… nor if you set wgMFPhotoUploadEndpoint to "http://127.0.0.1:8080/w/api.php".

This isn't a fire bucket task, as our production setup shouldn't trigger this behaviour.