Update start.sh

start.sh

@@ -19,33 +19,41 @@ nginx
 # 3. Start API (port 5001)
 echo "🧠 Starting API..."
 
-# NUCLEAR PATCH: Use SED to modify source files directly
-echo "🔧 Applying SED patches to Dify source..."
-
-# Find and patch all Python files that set httponly
-find /app/api -name "*.py" -type f -exec grep -l -i "httponly" {} \; 2>/dev/null | while read file; do
-    echo "   Patching: $file"
-    sed -i 's/httponly=True/httponly=False/gi' "$file" 2>/dev/null || true
-    sed -i 's/httponly = True/httponly = False/gi' "$file" 2>/dev/null || true
-    sed -i "s/httponly':True/httponly':False/gi" "$file" 2>/dev/null || true
-    sed -i "s/httponly': True/httponly': False/gi" "$file" 2>/dev/null || true
-    sed -i 's/"httponly": True/"httponly": False/gi' "$file" 2>/dev/null || true
-    sed -i "s/'httponly': True/'httponly': False/gi" "$file" 2>/dev/null || true
-done
-
-# Also patch cookie settings in configs
-find /app/api -name "*.py" -type f -exec grep -l -i "CSRF_COOKIE_HTTPONLY\|SESSION_COOKIE" {} \; 2>/dev/null | while read file; do
-    echo "   Config Patching: $file"
-    # Set CSRF_COOKIE_HTTPONLY to False
-    sed -i 's/CSRF_COOKIE_HTTPONLY.*=.*True/CSRF_COOKIE_HTTPONLY = False/gi' "$file" 2>/dev/null || true
-    # Set SESSION_COOKIE_SAMESITE to None
-    sed -i "s/SESSION_COOKIE_SAMESITE.*=.*/SESSION_COOKIE_SAMESITE = 'None'/gi" "$file" 2>/dev/null || true
-done
-
-echo "🔧 SED patches complete!"
-
-# Run Gunicorn 
-gunicorn --bind 127.0.0.1:5001 --workers 1 --timeout 360 --forwarded-allow-ips='*' app:app &
+# SAFE MIDDLEWARE PATCH: Create a wrapper that modifies cookies in responses
+cat << 'MIDDLEWARE_EOF' > /app/api/cookie_patch_middleware.py
+"""WSGI Middleware to fix cookie HttpOnly for CSRF tokens on HF Spaces"""
+from app import app as flask_app
+
+class CookiePatchMiddleware:
+    def __init__(self, app):
+        self.app = app
+    
+    def __call__(self, environ, start_response):
+        def custom_start_response(status, headers, exc_info=None):
+            new_headers = []
+            for name, value in headers:
+                if name.lower() == 'set-cookie' and 'csrf' in value.lower():
+                    # Remove HttpOnly from CSRF cookies
+                    value = value.replace('; HttpOnly', '').replace(';HttpOnly', '')
+                    # Ensure SameSite=None and Secure
+                    if 'SameSite' not in value:
+                        value += '; SameSite=None'
+                    if 'Secure' not in value:
+                        value += '; Secure'
+                    print(f"🔧 MIDDLEWARE PATCHED CSRF COOKIE: {value[:50]}...")
+                new_headers.append((name, value))
+            return start_response(status, new_headers, exc_info)
+        return self.app(environ, custom_start_response)
+
+# Wrap the Flask app with our middleware
+app = CookiePatchMiddleware(flask_app)
+print("✅ COOKIE PATCH MIDDLEWARE LOADED!")
+MIDDLEWARE_EOF
+
+echo "🔧 Cookie patch middleware created!"
+
+# Run Gunicorn with the middleware wrapper
+gunicorn --bind 127.0.0.1:5001 --workers 1 --timeout 360 --forwarded-allow-ips='*' cookie_patch_middleware:app &
 API_PID=$!
 
 # 4. Start Web (port 3000) with correct API URLs