Update app.py

app.py

@@ -30,13 +30,12 @@ CORS(app, resources={r"/*": {"origins": "*"}}, supports_credentials=True,
 
 app.config.update(
     SECRET_KEY=os.environ.get('SECRET_KEY', secrets.token_urlsafe(32)),
-    SESSION_COOKIE_SECURE=os.environ.get('FLASK_ENV') == 'production',  # True on Hugging Face Spaces (HTTPS)
+    SESSION_COOKIE_SECURE=True,               # Required for HTTPS
     SESSION_COOKIE_HTTPONLY=True,
-    SESSION_COOKIE_SAMESITE='None',          # Required for cross‑origin iframe
-    SESSION_COOKIE_DOMAIN='.hf.space',       # Allows cookie across all Spaces subdomains
+    SESSION_COOKIE_SAMESITE='Lax',            # Lax works for same‑site requests (no cross‑site needed)
+    # SESSION_COOKIE_DOMAIN='.hf.space',      # Do NOT set – let it default to the current domain
     PERMANENT_SESSION_LIFETIME=timedelta(hours=24),
     SESSION_COOKIE_NAME='tmc_session',
-    WTF_CSRF_TIME_LIMIT=3600
 )
 
 try: