Allow Hugging Face Spaces cookie sharing and CORS origins

backend/__init__.py

@@ -37,17 +37,17 @@ def create_app(config_override: dict | None = None) -> Flask:
     )
     app.config["SQLALCHEMY_TRACK_MODIFICATIONS"] = False
     app.config["SESSION_COOKIE_HTTPONLY"]    = True
-    app.config["SESSION_COOKIE_SAMESITE"]    = "Lax"
+    app.config["SESSION_COOKIE_SAMESITE"]    = "None"
     app.config["SESSION_COOKIE_SECURE"]      = True
 
     if config_override:
         app.config.update(config_override)
 
-    # ── Extensions ───────────────────────────────────────────────────────────
+    # ── Extensions ───────────────────────────────────────────────────────
     db.init_app(app)
-    default_origins = "http://localhost:5173,http://127.0.0.1:5173"
-    CORS(app, supports_credentials=True,
-         origins=os.environ.get("CORS_ORIGINS", default_origins).split(","))
+    default_origins = "http://localhost:5173,http://127.0.0.1:5173,https://huggingface.co,https://hf.space"
+    origins = os.environ.get("CORS_ORIGINS", default_origins).split(",")
+    CORS(app, supports_credentials=True, origins=origins)
 
     # ── Blueprints ───────────────────────────────────────────────────────────
     from .routes.auth        import auth_bp