Auth: Set-Cookie session + credentials include (HF strips Authorization on GET)

app.py

@@ -20,7 +20,7 @@ from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any, Optional
 
-from fastapi import FastAPI, HTTPException, Query, Depends, Cookie, Header
+from fastapi import FastAPI, HTTPException, Query, Depends, Cookie, Header, Response
 from fastapi.staticfiles import StaticFiles
 from fastapi.responses import FileResponse, JSONResponse
 from pydantic import BaseModel
@@ -174,13 +174,26 @@ class AuthPayload(BaseModel):
 
 
 @app.post("/api/auth")
-def authenticate(payload: AuthPayload):
-    """Verify password and return a signed session token (survives server restarts)."""
+def authenticate(payload: AuthPayload, response: Response):
+    """Verify password and return a signed session token (survives server restarts).
+
+    Also sets an HttpOnly ``session`` cookie so GET requests work when a reverse proxy
+    strips the ``Authorization`` header (common on Hugging Face Spaces).
+    """
     if not config.APP_PASSWORD:
         return {"ok": True, "token": ""}
     if not hmac.compare_digest(payload.password, config.APP_PASSWORD):
         raise HTTPException(status_code=403, detail="Wrong password")
-    return {"ok": True, "token": _issue_signed_session_token()}
+    token = _issue_signed_session_token()
+    response.set_cookie(
+        key="session",
+        value=token,
+        max_age=_SESSION_TTL_SEC,
+        httponly=True,
+        samesite="lax",
+        path="/",
+    )
+    return {"ok": True, "token": token}
 
 
 @app.get("/api/auth/mode")
@@ -200,8 +213,10 @@ def auth_check(authorization: Optional[str] = Header(None), session: str = Cooki
 
 def _extract_token(authorization: Optional[str] = None, session: Optional[str] = None) -> Optional[str]:
     if authorization and authorization.startswith("Bearer "):
-        return authorization[7:]
-    return session
+        t = authorization[7:].strip()
+        if t:
+            return t
+    return session if session else None
 
 
 def _require_auth(authorization: Optional[str] = Header(None), session: str = Cookie(None)):

static/index.html

@@ -324,6 +324,17 @@
 <script>
 (function(){
 
+  /* Ensure cookies (session) are sent on /api/* — HF proxy may strip Authorization on GET. */
+  const _nativeFetch = window.fetch;
+  window.fetch = function(input, init) {
+    init = init ? {...init} : {};
+    const u = typeof input === "string" ? input : (input && input.url) || "";
+    if (u.startsWith("/api") && init.credentials === undefined) {
+      init.credentials = "include";
+    }
+    return _nativeFetch.call(window, input, init);
+  };
+
   /* ── i18n ───────────────────────────────────────────────────────────── */
   const I18N = {
     en: {

static/rag_eval.html

@@ -314,7 +314,7 @@ async function api(path, opts={}) {
     headers['Content-Type'] = 'application/json';
     opts.body = JSON.stringify(opts.body);
   }
-  const res = await fetch(path, {...opts, headers});
+  const res = await fetch(path, {...opts, headers, credentials: "include"});
   if (res.status === 401) { showLogin(); throw new Error('Auth required'); }
   if (!res.ok) {
     const err = await res.json().catch(() => ({detail: res.statusText}));
@@ -329,7 +329,7 @@ function hideLogin() { document.getElementById('login-overlay').style.display =
 async function doLogin() {
   const pw = document.getElementById('login-pw').value;
   try {
-    const r = await fetch('/api/auth', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify({password:pw})});
+    const r = await fetch('/api/auth', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify({password:pw}), credentials:'include'});
     const d = await r.json();
     if (d.ok) { TOKEN = d.token; localStorage.setItem('auth_token', TOKEN); hideLogin(); loadSheets(); }
     else { document.getElementById('login-error').style.display='block'; }

static/train.html

@@ -517,11 +517,11 @@ function headers() {
 }
 
 async function api(path, opts = {}) {
-  const res = await fetch(path, {headers: headers(), ...opts});
+  const res = await fetch(path, {headers: headers(), credentials: 'include', ...opts});
   if (res.status === 401) {
     const pw = prompt('Enter password:');
     if (!pw) return null;
-    const auth = await fetch('/api/auth', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify({password:pw})});
+    const auth = await fetch('/api/auth', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify({password:pw}), credentials:'include'});
     if (auth.ok) { const d = await auth.json(); token = d.token; localStorage.setItem('labeler_token', token); return api(path, opts); }
     return null;
   }