test with samesite none

app.py

@@ -36,8 +36,8 @@ def show_profile(request: gr.Request) -> str:
 
 def js_open(url: str) -> str:
     # Taken from https://cmgdo.com/external-link-in-gradio-button/
-    return f"function() {{window.location.assign('{url}');}}"
-    # return f"function() {{window.open('{url}', '_blank');}}"
+    # return f"function() {{window.location.assign('{url}');}}"
+    return f"function() {{window.open('{url}', '_blank');}}"
 
 
 with gr.Blocks() as demo:

auth.py

@@ -1,9 +1,10 @@
 import os
 import hashlib
+from typing import Any
 from authlib.integrations.starlette_client import OAuth
 from fastapi import FastAPI
 from fastapi.requests import Request
-from fastapi.responses import RedirectResponse
+from fastapi.responses import RedirectResponse, HTMLResponse
 from starlette.middleware.sessions import SessionMiddleware
 
 
@@ -19,6 +20,7 @@ for value in (OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, OAUTH_SCOPES, OPENID_PROVIDE
 USER_INFO_URL = OPENID_PROVIDER_URL + "/oauth/userinfo"
 METADATA_URL = OPENID_PROVIDER_URL + "/.well-known/openid-configuration"
 
+
 oauth = OAuth()
 oauth.register(
     name="huggingface",
@@ -30,32 +32,36 @@ oauth.register(
 
 # Hack to close the login/logout page once the user is logged in/out.
 # TODO: can it be less hacky?
-# CLOSE_WINDOW_HTML = HTMLResponse("<script>window.close();</script>")
+CLOSE_WINDOW_HTML = HTMLResponse("<script>window.close();</script>")
 
 
 async def oauth_login(request: Request):
     redirect_uri = str(request.url_for("oauth_redirect_callback"))
     if ".hf.space" in redirect_uri:  # In Space, FastAPI redirect as http but we want https
         redirect_uri = redirect_uri.replace("http://", "https://")
-    print(redirect_uri)
     return await oauth.huggingface.authorize_redirect(request, redirect_uri)
 
 
 async def oauth_logout(request: Request) -> RedirectResponse:
     request.session.pop("user", None)
-    return RedirectResponse("/")
+    # return RedirectResponse("/")
+    return CLOSE_WINDOW_HTML
 
 
 async def oauth_redirect_callback(request: Request) -> RedirectResponse:
-    print("this one")
-    print(request.session)
     token = await oauth.huggingface.authorize_access_token(request)
     request.session["user"] = token["userinfo"]  # TODO: we should store entire token
-    return RedirectResponse("/")
+    # return RedirectResponse("/")
+    return CLOSE_WINDOW_HTML
 
 
 def attach_oauth(app: FastAPI) -> None:
-    app.add_middleware(SessionMiddleware, secret_key=hashlib.sha256(OAUTH_CLIENT_SECRET.encode()).hexdigest())
+    app.add_middleware(
+        SessionMiddleware,
+        secret_key="000" + hashlib.sha256(OAUTH_CLIENT_SECRET.encode()).hexdigest(),
+        same_site="none",
+        https_only=True,
+    )
     app.get("/login/huggingface")(oauth_login)
     app.get("/login/callback")(oauth_redirect_callback)
     app.get("/logout")(oauth_logout)