Allow credentialed Gradio CORS from custom domain

app.py

@@ -385,6 +385,7 @@ logger.info("All routes configured")
 
 # Mount the REST API on /api
 from fastapi import FastAPI, Request
+from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import RedirectResponse
 from starlette.middleware.base import BaseHTTPMiddleware
 from api import api_app
@@ -481,6 +482,14 @@ root_app.mount("/api", api_app)
 
 # Mount Gradio app at root path
 app = gr.mount_gradio_app(root_app, demo, path="/")
+app = CORSMiddleware(
+    app,
+    allow_origins=["https://index.openhands.dev"],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+    expose_headers=["*"],
+)
 app = StringifiedGradioJSONMiddleware(app)
 logger.info("REST API mounted at /api, Gradio app mounted at /")