test

app.py

@@ -36,8 +36,7 @@ def show_profile(request: gr.Request) -> str:
 
 def js_open(url: str) -> str:
     # Taken from https://cmgdo.com/external-link-in-gradio-button/
-    return f"function() {{window.location.assign('{url}');}}"
-    # return f"function() {{window.open('{url}', '_blank');}}"
+    return f"function() {{window.open('{url}', '_blank');}}"
 
 
 with gr.Blocks() as demo:

auth.py

@@ -6,6 +6,7 @@ from fastapi import FastAPI
 from fastapi.requests import Request
 from fastapi.responses import RedirectResponse, HTMLResponse
 from starlette.middleware.sessions import SessionMiddleware
+from authlib.integrations.base_client import MismatchingStateError
 
 
 OAUTH_CLIENT_ID = os.environ.get("OAUTH_CLIENT_ID")
@@ -33,6 +34,7 @@ oauth.register(
 # Hack to close the login/logout page once the user is logged in/out.
 # TODO: can it be less hacky?
 CLOSE_WINDOW_HTML = HTMLResponse("<script>window.close();</script>")
+OPEN_WINDOW_HTML = HTMLResponse("<script>window.open('{url}', '_blank');</script>")
 
 
 async def oauth_login(request: Request):
@@ -44,16 +46,21 @@ async def oauth_login(request: Request):
 
 async def oauth_logout(request: Request) -> RedirectResponse:
     request.session.pop("user", None)
-    return RedirectResponse("/")
-    # return CLOSE_WINDOW_HTML
+    return CLOSE_WINDOW_HTML
+    return CLOSE_WINDOW_HTML if close_tab else RedirectResponse("/")
 
 
 async def oauth_redirect_callback(request: Request) -> RedirectResponse:
-    token = await oauth.huggingface.authorize_access_token(request)
-    request.session["user"] = token["userinfo"]  # TODO: we should store entire token
-    print(f"New user: {token['userinfo']['name']}")
-    return RedirectResponse("/")
-    # return CLOSE_WINDOW_HTML
+    try:
+        token = await oauth.huggingface.authorize_access_token(request)
+        request.session["user"] = token["userinfo"]  # TODO: we should store the entire token
+        close_tab = True
+    except MismatchingStateError:
+        # Third-party cookies are most likely forbidden meaning the session will not be set inside the Space iframe.
+        # To counterpart this, we redirect the user to use the Space url outside of the iframe.
+        close_tab = False
+
+    return CLOSE_WINDOW_HTML if close_tab else OPEN_WINDOW_HTML.format(url=request.url_for("oauth_login"))
 
 
 def attach_oauth(app: FastAPI) -> None: