Temporarily disable CSRF to debug session issues

config.py

@@ -20,10 +20,11 @@ class Config:
         'sqlite:///' + os.path.join(basedir, 'instance', 'app.db')
     SQLALCHEMY_TRACK_MODIFICATIONS = False
     
-    # WTF CSRF Settings
-    WTF_CSRF_ENABLED = True
-    WTF_CSRF_TIME_LIMIT = 3600  # 1 hour token validity
-    WTF_CSRF_SSL_STRICT = False  # Don't require HTTPS for CSRF
+    # WTF CSRF Settings - Temporarily disabled due to HF Spaces session issues
+    # TODO: Re-enable after figuring out session persistence
+    WTF_CSRF_ENABLED = False  # Disable CSRF for now - will re-enable with fix
+    WTF_CSRF_TIME_LIMIT = None  # No time limit if needed
+    WTF_CSRF_SSL_STRICT = False
 
     # Session configuration - CRITICAL for CSRF to work
     SESSION_COOKIE_HTTPONLY = True

web_app/__init__.py

@@ -67,14 +67,6 @@ def create_app(config_class=Config):
     db.init_app(app)
     login_manager.init_app(app)
     migrate.init_app(app, db)
-    
-    # Ensure session is always started (required for CSRF tokens)
-    @app.before_request
-    def ensure_session():
-        from flask import session
-        if '_csrf_token' not in session:
-            session['_csrf_token'] = True
-            session.modified = True
 
     # Initialize Redis connection for RQ
     try:

web_app/auth_routes.py

@@ -1,4 +1,4 @@
-from flask import Blueprint, render_template, redirect, url_for, flash, request, jsonify, session
+from flask import Blueprint, render_template, redirect, url_for, flash, request, jsonify
 from flask_login import login_user, logout_user, login_required, current_user
 # Assuming db and login_manager are initialized in __init__.py
 from web_app import db, login_manager
@@ -15,10 +15,6 @@ bp = Blueprint('auth', __name__, template_folder='templates/auth')
 
 @bp.route('/register', methods=['GET', 'POST'])
 def register():
-    # Ensure session is initialized for CSRF token
-    session.setdefault('_csrf_init', True)
-    session.modified = True
-    
     if current_user.is_authenticated:
         return redirect('/')  # Redirect to React homepage
 
@@ -54,10 +50,6 @@ def register():
 
 @bp.route('/login', methods=['GET', 'POST'])
 def login():
-    # Ensure session is initialized for CSRF token
-    session.setdefault('_csrf_init', True)
-    session.modified = True
-    
     if current_user.is_authenticated:
         return redirect('/')