diff --git a/backend/api/v1/communications/views.py b/backend/api/v1/communications/views.py
index 2a7757d2..13f09a2e 100644
--- a/backend/api/v1/communications/views.py
+++ b/backend/api/v1/communications/views.py
@@ -5,6 +5,7 @@ from django.contrib.auth.decorators import login_required
 from django.db import transaction
 from django.http import JsonResponse
 from django.shortcuts import get_object_or_404
+from django.views.decorators.csrf import ensure_csrf_cookie
 from django.views.decorators.http import require_POST
 
 from communications.models import (
@@ -17,6 +18,7 @@ from communications.models import (
 
 @login_required
 @require_POST
+@ensure_csrf_cookie
 def upload_message_with_attachments(request):
     """Отправка сообщения с вложениями"""
     chat_id = request.POST.get('chat_id')
diff --git a/backend/templates/communications/chat_detail.html b/backend/templates/communications/chat_detail.html
index 04f2f4b7..de1a0acf 100644
--- a/backend/templates/communications/chat_detail.html
+++ b/backend/templates/communications/chat_detail.html
@@ -220,6 +220,22 @@
 </div>
 
 <script>
+// Функция для получения CSRF токена из cookie
+function getCookie(name) {
+  let cookieValue = null;
+  if (document.cookie && document.cookie !== '') {
+    const cookies = document.cookie.split(';');
+    for (let i = 0; i < cookies.length; i++) {
+      const cookie = cookies[i].trim();
+      if (cookie.substring(0, name.length + 1) === (name + '=')) {
+        cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
+        break;
+      }
+    }
+  }
+  return cookieValue;
+}
+
 // Обработка вложений
 document.addEventListener('DOMContentLoaded', function() {
   const attachDocument = document.getElementById('attachDocument');
@@ -343,12 +359,14 @@ document.addEventListener('DOMContentLoaded', function() {
       
       formData.append('chat_id', '{{ chat.id }}');
       
+      const csrftoken = getCookie('csrftoken');
+      
       try {
         const response = await fetch('/api/v1/communications/upload-message/', {
           method: 'POST',
           body: formData,
           headers: {
-            'X-CSRFToken': document.querySelector('[name=csrfmiddlewaretoken]').value
+            'X-CSRFToken': csrftoken
           }
         });