Space: send upgrade-insecure-requests as response header (meta too late for Gradio's early theme.css link)

app.py

@@ -104,6 +104,20 @@ with gr.Blocks(title="Tiny Army") as demo:
 
 # Mount Gradio on FastAPI so we can also serve the JS module + the sprite assets.
 fastapi_app = FastAPI()
+
+
+# Behind HF's custom-domain proxy Gradio emits its theme.css <link> as http://
+# (the app doesn't see HTTPS), and that link is in the HTML *before* our head=
+# meta — so a meta CSP can't upgrade it in time. Sending the CSP as a response
+# HEADER governs the whole document regardless of in-page order, so the browser
+# upgrades the http theme.css (and any other mixed content) to https.
+@fastapi_app.middleware("http")
+async def upgrade_insecure(request, call_next):
+    resp = await call_next(request)
+    resp.headers["Content-Security-Policy"] = "upgrade-insecure-requests"
+    return resp
+
+
 fastapi_app.mount("/web", StaticFiles(directory=WEB), name="web")
 # NOTE: serve sprite assets at /sprites, NOT /assets — Gradio serves its own UI
 # bundle from /assets, and mounting there shadows it (breaks the whole UI).