'change session type'

Dockerfile

@@ -12,6 +12,7 @@ COPY migrations/ migrations/
 COPY entrypoint.sh /app/entrypoint.sh
 
 RUN mkdir -p data
+RUN mkdir -p data/flask_sessions
 RUN chmod +x /app/entrypoint.sh
 
 EXPOSE 7860

requirements.txt

@@ -1,6 +1,7 @@
 # Core web framework
 Flask==3.0.0
 Flask-WTF==1.2.1
+Flask-Session==0.5.0
 
 # Authentication
 Authlib==1.2.1

src/app.py

@@ -10,6 +10,7 @@ import time
 from datetime import timedelta
 
 from flask import Flask, jsonify, request, g
+from flask_session import Session
 from dotenv import load_dotenv
 from opentelemetry import trace
 from opentelemetry.trace import Status, StatusCode
@@ -65,6 +66,13 @@ def create_app():
     # Configuration
     app.config["SECRET_KEY"] = os.getenv("SECRET_KEY", "dev-secret-key-change-me")
     
+    # CRITICAL: Use server-side sessions to avoid cookie size limits (4KB)
+    # OAuth state tokens make cookies exceed size limit, causing state to be lost
+    app.config["SESSION_TYPE"] = "filesystem"  # Store sessions server-side
+    app.config["SESSION_FILE_DIR"] = "/app/data/flask_sessions"  # Session storage directory
+    app.config["SESSION_PERMANENT"] = False  # Default to non-permanent (override per-session)
+    app.config["SESSION_USE_SIGNER"] = True  # Sign session cookie for security
+    
     # Session cookie configuration
     # For HTTPS (HF Spaces): Set SESSION_COOKIE_SECURE=true
     secure_cookie = os.getenv("SESSION_COOKIE_SECURE", "False").lower() == "true"
@@ -117,6 +125,10 @@ def create_app():
     # Initialize database
     init_db()
 
+    # Initialize Flask-Session (must be BEFORE OAuth init)
+    # This stores sessions server-side to avoid 4KB cookie size limit
+    Session(app)
+
     # Initialize OAuth
     auth_service.init_app(app)