Fixed

app.py

@@ -3,6 +3,7 @@ from apscheduler.schedulers.background import BackgroundScheduler
 from datetime import datetime
 import traceback
 import os
+import secrets
 
 from config import RSS_URL, APP_TITLE, APP_SOURCE_NAME, FETCH_INTERVAL_MINUTES, DATABASE, TIMEZONE
 from db import init_db, upsert_article, get_latest, get_article_by_guid
@@ -35,14 +36,17 @@ def load_keywords():
 
 app = Flask(__name__)
 # Use environment variable for secret key or generate a secure one
-app.secret_key = os.environ.get('SECRET_KEY', 'fallback-secret-key-change-in-production-2024')
+import secrets
+app.secret_key = os.environ.get('SECRET_KEY', secrets.token_hex(32))
 
-# Configure session to be more reliable in production
-app.config['SESSION_COOKIE_SECURE'] = False  # Set to True if using HTTPS
+# Configure session to be more reliable in HF Spaces containerized environment
+app.config['SESSION_COOKIE_SECURE'] = False  # HF Spaces uses HTTP internally
 app.config['SESSION_COOKIE_HTTPONLY'] = True
 app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
 app.config['PERMANENT_SESSION_LIFETIME'] = 7200  # 2 hours
 app.config['SESSION_COOKIE_NAME'] = 'news_session'
+app.config['SESSION_COOKIE_PATH'] = '/'
+app.config['SESSION_COOKIE_DOMAIN'] = None  # Let Flask handle this automatically
 
 # Ensure DB is initialized for all environments (including production)
 init_db(DATABASE)
@@ -67,12 +71,16 @@ def login():
         username = request.form['username']
         password = request.form['password']
         if check_user(username, password):
+            session.clear()  # Clear any existing session data
             session['username'] = username
+            session['authenticated'] = True
             session.permanent = True  # Make session permanent
-            print(f"User {username} logged in successfully. Session set.")
+            # Add extra debugging for HF Spaces
+            print(f"✅ User {username} logged in successfully")
+            print(f"✅ Session data: {dict(session)}")
             return redirect(url_for('home'))
         else:
-            print(f"Failed login attempt for username: {username}")
+            print(f"❌ Failed login attempt for username: {username}")
             error_message = 'Invalid username or password'
             return render_template('login.html', app_title=APP_TITLE, error=error_message)
     return render_template('login.html', app_title=APP_TITLE)
@@ -83,6 +91,16 @@ def logout():
     print("User logged out, session cleared")
     return redirect(url_for('login'))
 
+@app.route('/debug-session')
+def debug_session():
+    """Debug route to check session status"""
+    return {
+        'session_keys': list(session.keys()),
+        'session_data': dict(session),
+        'authenticated': session.get('authenticated', False),
+        'username': session.get('username', 'Not set')
+    }
+
 def fetch_and_update():
     """
     1) Parse RSS
@@ -133,14 +151,23 @@ def fetch_and_update():
 # Home page now fetches and displays news from 5 RSS feeds filtered by keywords
 @app.route("/")
 def home():
-    print(f"Home route accessed. Session keys: {list(session.keys())}")
-    print(f"Username in session: {'username' in session}")
+    print(f"🏠 Home route accessed")
+    print(f"🔍 Session keys: {list(session.keys())}")
+    print(f"👤 Session data: {dict(session)}")
     
-    if 'username' not in session:
-        print("No username in session, redirecting to login")
+    # Check multiple conditions for authentication
+    username_exists = 'username' in session
+    auth_flag = session.get('authenticated', False)
+    
+    print(f"✅ Username in session: {username_exists}")
+    print(f"✅ Authenticated flag: {auth_flag}")
+    
+    if not username_exists or not auth_flag:
+        print("❌ Authentication failed, redirecting to login")
+        session.clear()  # Clear any corrupted session data
         return redirect(url_for('login'))
     
-    print(f"User {session['username']} accessing home page")
+    print(f"✅ User {session['username']} successfully accessing home page")
     
     try:
         keywords = load_keywords()