Fix auth loop: use TimestampSigner + base64 to match Starlette SessionMiddleware

app/auth.py

@@ -7,36 +7,37 @@ from fastapi import HTTPException, Request, status
 from starlette.middleware.sessions import SessionMiddleware
 from starlette.responses import JSONResponse, HTMLResponse
 from starlette.types import ASGIApp, Receive, Scope, Send
-from itsdangerous import URLSafeSerializer, BadSignature
+from itsdangerous import TimestampSigner, BadSignature
+import base64
+import json
 import secrets
 import time
 from typing import Optional, Callable
 from app.config import settings
 
 
-# Session serializer for decoding cookies in middleware
-# Must match Starlette's SessionMiddleware exactly
-def get_session_serializer():
-    """Create a serializer matching SessionMiddleware's format exactly"""
-    # Starlette uses URLSafeSerializer (not URLSafeTimedSerializer)
-    # with these exact parameters
-    return URLSafeSerializer(
-        settings.SESSION_SECRET_KEY,
-        salt="cookie-session",
-        signer_kwargs={
-            "key_derivation": "hmac",
-            "digest_method": "sha1"
-        }
-    )
-
-
 def decode_session_cookie(cookie_value: str) -> dict:
-    """Decode session cookie value to dictionary"""
+    """
+    Decode session cookie value to dictionary.
+    Must match Starlette's SessionMiddleware encoding exactly:
+    1. TimestampSigner signs the data
+    2. Data is base64 encoded JSON
+    """
     if not cookie_value:
         return {}
     try:
-        serializer = get_session_serializer()
-        return serializer.loads(cookie_value)
+        # Create the same signer that SessionMiddleware uses
+        signer = TimestampSigner(
+            settings.SESSION_SECRET_KEY,
+            salt="cookie-session"
+        )
+        
+        # Unsign the cookie value
+        unsigned_value = signer.unsign(cookie_value)
+        
+        # Decode base64 and parse JSON
+        decoded = base64.urlsafe_b64decode(unsigned_value)
+        return json.loads(decoded)
     except (BadSignature, Exception) as e:
         # Log error for debugging but don't crash
         print(f"Session decode error: {e}")
@@ -377,4 +378,4 @@ def get_login_html(error: str = None) -> str:
         document.getElementById('password').focus();
     </script>
 </body>
-</html>'''
+</html>'''