Update main.py

main.py

@@ -252,7 +252,7 @@ async def register(request: RegisterRequest):
 @app.post("/api/auth/login")
 async def login(request: LoginRequest):
     """
-    Enhanced login endpoint with cookie setting and proper redirection
+    Enhanced login endpoint with cookie setting and proper redirection for Hugging Face Spaces
     """
     try:
         print(f"🔐 Login attempt for username: {request.username}")
@@ -296,14 +296,17 @@ async def login(request: LoginRequest):
             response.set_cookie(
                 key="authToken",
                 value=result["token"],
-                httponly=True,  # Prevent XSS attacks
-                secure=True,    # HTTPS only (Hugging Face Spaces uses HTTPS)
-                samesite="lax", # CSRF protection while allowing normal navigation
+                httponly=False,  # Allow JavaScript access for debugging
+                secure=False,    # Don't require HTTPS for internal communication
+                samesite="lax",  # CSRF protection while allowing normal navigation
                 max_age=24*60*60,  # 24 hours
-                path="/"
+                path="/",
+                domain=None      # Let browser determine domain
             )
             
             print(f"🍪 Cookie set for user: {username}")
+            print(f"🎯 Token: {result['token'][:20]}...")  # Show first 20 chars
+            
             return response
             
         else:
@@ -353,7 +356,7 @@ async def login_page(request: Request):
 
 @app.post("/api/auth/logout")
 async def logout(request: Request):
-    """Enhanced logout with proper cookie clearing"""
+    """Enhanced logout with proper cookie clearing for Hugging Face Spaces"""
     try:
         # Get current user to invalidate their session
         user = await get_current_user_web(request)
@@ -364,12 +367,12 @@ async def logout(request: Request):
         response_data = {"success": True, "message": "Logged out successfully"}
         response = JSONResponse(content=response_data)
         
-        # Clear the authentication cookie
+        # Clear the authentication cookie with same settings as login
         response.delete_cookie(
             key="authToken",
             path="/",
             domain=None,
-            secure=True,
+            secure=False,
             samesite="lax"
         )
         
@@ -379,7 +382,13 @@ async def logout(request: Request):
         print(f"❌ Logout error: {e}")
         # Still return success and clear cookie even if there's an error
         response = JSONResponse(content={"success": True, "message": "Logged out"})
-        response.delete_cookie("authToken", path="/")
+        response.delete_cookie(
+            key="authToken", 
+            path="/",
+            domain=None,
+            secure=False,
+            samesite="lax"
+        )
         return response
 
 # Web interface routes (protected)