Fix CSRF token issues for Hugging Face Spaces deployment

- Add HuggingFaceConfig class with relaxed CSRF/session settings
- Disable SESSION_COOKIE_SECURE and WTF_CSRF_SSL_STRICT for HF Spaces
- Add enhanced CSRF error handling with debugging
- Remove duplicate error handlers
- Update deployment checklist with HF-specific configuration
- Set FLASK_ENV=huggingface for optimal HF Spaces compatibility

HUGGINGFACE_DEPLOYMENT_CHECKLIST.md

@@ -62,13 +62,13 @@
 SECRET_KEY=your-64-character-production-secret-key
 MONGODB_URL=your-mongodb-atlas-connection-string
 MONGODB_DATABASE=Atlas
-FLASK_ENV=production
+FLASK_ENV=huggingface
 ```
 
-#### Security Variables:
+#### Security Variables (Hugging Face Spaces optimized):
 ```
-SESSION_COOKIE_SECURE=true
-WTF_CSRF_SSL_STRICT=true
+SESSION_COOKIE_SECURE=false
+WTF_CSRF_SSL_STRICT=false
 MAX_LOGIN_ATTEMPTS=3
 RATE_LIMIT_WINDOW=1800
 ```
@@ -285,9 +285,9 @@ Copy these to your Hugging Face Space settings:
 SECRET_KEY=your-generated-secret-key-here
 MONGODB_URL=mongodb+srv://username:password@cluster.mongodb.net/?retryWrites=true&w=majority&appName=Chatty
 MONGODB_DATABASE=Atlas
-FLASK_ENV=production
-SESSION_COOKIE_SECURE=true
-WTF_CSRF_SSL_STRICT=true
+FLASK_ENV=huggingface
+SESSION_COOKIE_SECURE=false
+WTF_CSRF_SSL_STRICT=false
 MAX_LOGIN_ATTEMPTS=3
 RATE_LIMIT_WINDOW=1800
 SESSION_LIFETIME_HOURS=24

app.py

@@ -29,9 +29,30 @@ app = Flask(__name__)
 config_class = get_config()
 app.config.from_object(config_class)
 
-# CSRF Protection
+# CSRF Protection with error handling
 csrf = CSRFProtect(app)
 
+# Add CSRF error handler for debugging
+@app.errorhandler(400)
+def handle_csrf_error(e):
+    """Handle CSRF errors with better debugging"""
+    error_description = str(e.description) if hasattr(e, 'description') else str(e)
+    
+    # Log CSRF errors for debugging
+    app.logger.warning(f"CSRF Error: {error_description}")
+    app.logger.warning(f"Request headers: {dict(request.headers)}")
+    app.logger.warning(f"Request form: {dict(request.form)}")
+    app.logger.warning(f"Session: {dict(session)}")
+    
+    if 'CSRF' in error_description:
+        flash('Security token expired. Please try again.', 'error')
+        # Redirect back to the same page to regenerate CSRF token
+        if request.endpoint in ['login', 'register']:
+            return redirect(url_for(request.endpoint))
+        return redirect(url_for('login'))
+    
+    return render_template('errors/400.html'), 400
+
 # Configure logging
 logging.basicConfig(
     level=getattr(logging, app.config['LOG_LEVEL']),
@@ -398,13 +419,7 @@ def health():
     """
     return jsonify({"status": "healthy"})
 
-@app.errorhandler(400)
-def handle_bad_request(e):
-    """Handle bad request errors including CSRF"""
-    if 'CSRF' in str(e):
-        flash('Security token expired. Please try again.', 'error')
-        return redirect(request.url)
-    return render_template('errors/400.html'), 400
+# Error handler for 400 is already defined above with CSRF debugging
 
 @app.errorhandler(401)
 def handle_unauthorized(e):

config.py

@@ -30,6 +30,10 @@ class Config:
     # CSRF Configuration
     WTF_CSRF_TIME_LIMIT = int(os.environ.get('CSRF_TIME_LIMIT', 3600))  # 1 hour
     WTF_CSRF_SSL_STRICT = os.environ.get('WTF_CSRF_SSL_STRICT', 'False').lower() == 'true'
+    WTF_CSRF_ENABLED = os.environ.get('WTF_CSRF_ENABLED', 'True').lower() == 'true'
+    
+    # Additional CSRF settings for proxy environments (like Hugging Face Spaces)
+    WTF_CSRF_CHECK_DEFAULT = os.environ.get('WTF_CSRF_CHECK_DEFAULT', 'True').lower() == 'true'
     
     # Rate Limiting Configuration
     MAX_LOGIN_ATTEMPTS = int(os.environ.get('MAX_LOGIN_ATTEMPTS', 5))
@@ -73,8 +77,11 @@ class DevelopmentConfig(Config):
 class ProductionConfig(Config):
     """Production configuration"""
     DEBUG = False
-    SESSION_COOKIE_SECURE = True
-    WTF_CSRF_SSL_STRICT = True
+    
+    # Hugging Face Spaces compatibility
+    # HF Spaces runs behind a proxy, so we need to be more flexible with CSRF/session settings
+    SESSION_COOKIE_SECURE = os.environ.get('SESSION_COOKIE_SECURE', 'False').lower() == 'true'
+    WTF_CSRF_SSL_STRICT = os.environ.get('WTF_CSRF_SSL_STRICT', 'False').lower() == 'true'
     
     # Override with production-specific values
     MAX_LOGIN_ATTEMPTS = int(os.environ.get('MAX_LOGIN_ATTEMPTS', 3))  # Stricter in production
@@ -89,14 +96,37 @@ class ProductionConfig(Config):
         if not os.environ.get('SECRET_KEY'):
             errors.append("SECRET_KEY environment variable must be explicitly set in production")
         
-        if not ProductionConfig.SESSION_COOKIE_SECURE:
-            errors.append("SESSION_COOKIE_SECURE must be True in production (requires HTTPS)")
+        # Relaxed validation for Hugging Face Spaces compatibility
+        # SESSION_COOKIE_SECURE and WTF_CSRF_SSL_STRICT are now optional in production
         
         if ProductionConfig.DEBUG:
             errors.append("DEBUG must be False in production")
         
         return errors
 
+class HuggingFaceConfig(Config):
+    """Hugging Face Spaces specific configuration"""
+    DEBUG = False
+    
+    # Hugging Face Spaces runs behind proxies, so we need relaxed settings
+    SESSION_COOKIE_SECURE = False  # HF handles HTTPS at proxy level
+    WTF_CSRF_SSL_STRICT = False    # Don't enforce SSL for CSRF
+    SESSION_COOKIE_SAMESITE = 'Lax'  # More permissive for proxy environments
+    
+    # Production-level security for other settings
+    MAX_LOGIN_ATTEMPTS = int(os.environ.get('MAX_LOGIN_ATTEMPTS', 3))
+    RATE_LIMIT_WINDOW = int(os.environ.get('RATE_LIMIT_WINDOW', 1800))
+    
+    @staticmethod
+    def validate_config():
+        """Validation for Hugging Face Spaces"""
+        errors = Config.validate_config()
+        
+        if not os.environ.get('SECRET_KEY'):
+            errors.append("SECRET_KEY environment variable must be explicitly set")
+        
+        return errors
+
 class TestingConfig(Config):
     """Testing configuration"""
     TESTING = True
@@ -109,6 +139,7 @@ class TestingConfig(Config):
 config = {
     'development': DevelopmentConfig,
     'production': ProductionConfig,
+    'huggingface': HuggingFaceConfig,
     'testing': TestingConfig,
     'default': DevelopmentConfig
 }