Fix login in HF iframe: fresh-session CSRF + SameSite=None cookies

Two issues:
1. The Space runs in a cross-site iframe (hf.space inside huggingface.co).
SameSite=Lax cookies are blocked in this context, so the browser never
sends csrftoken to LS -> 403 CSRF error.
Fix: proxy handles CSRF entirely server-side (fresh requests.Session to LS),
so the browser's csrftoken is never needed.

2. Cookies returned after login had SameSite=Lax which is also blocked in the
iframe for subsequent requests.
Fix: set SameSite=None;Secure so cookies work in both direct and iframe access.

ls_proxy_hf.py

@@ -571,61 +571,71 @@ def login_get():
 @app.route("/user/login/", methods=["POST"])
 @app.route("/user/login", methods=["POST"])
 def login_post():
-    """Forward login POST directly to LS; intercept the success redirect to set long-lived cookies."""
+    """Open a fresh server-side LS session to handle CSRF, then forward cookies to browser.
+
+    We never rely on the browser's csrftoken cookie because the Space runs inside an
+    iframe on huggingface.co — cross-site context blocks SameSite=Lax cookies.
+    The proxy fetches a fresh CSRF token from LS directly and posts credentials
+    server-to-server.  Cookies are returned as SameSite=None;Secure so they work
+    both in direct-URL access and in the HF iframe.
+    """
     try:
-        # Pass the POST straight through — browser already has the matching csrftoken cookie
-        # set by login_get(), so LS CSRF validation will pass without any token manipulation.
-        headers = _fwd_headers(request)
-        csrf_val = request.form.get("csrfmiddlewaretoken", "")
-        if csrf_val:
-            headers["X-CSRFToken"] = csrf_val
-        # Override Origin and Referer: browser sends the HF Space domain, but Django
-        # compares Origin against Host (localhost:8080) and rejects cross-origin CSRF.
-        headers["Origin"] = LS_URL
-        headers["Referer"] = f"{LS_URL}/user/login/"
-
-        r = requests.post(
+        sess = requests.Session()
+        r0 = sess.get(f"{LS_URL}/user/login/", timeout=10)
+        if r0.status_code != 200:
+            return _ls_unavailable()
+
+        csrf_cookie = sess.cookies.get("csrftoken", "")
+        # Support any attribute order in the hidden input
+        m = (_re.search(r'name="csrfmiddlewaretoken"[^>]*value="([^"]+)"', r0.text) or
+             _re.search(r'value="([^"]+)"[^>]*name="csrfmiddlewaretoken"', r0.text))
+        csrf_token = m.group(1) if m else csrf_cookie
+
+        form = request.form.to_dict(flat=True)
+        form["csrfmiddlewaretoken"] = csrf_token
+
+        # allow_redirects=True so we get the final sessionid after Django session rotation
+        r1 = sess.post(
             f"{LS_URL}/user/login/",
-            data=request.get_data(),
-            headers=headers,
-            cookies=_ls_cookies(request),
-            allow_redirects=False,
+            data=form,
+            headers={"Referer": f"{LS_URL}/user/login/",
+                     "X-CSRFToken": csrf_token},
+            allow_redirects=True,
             timeout=15,
         )
+
+        if "/user/login" not in r1.url:
+            next_url = request.args.get("next") or request.form.get("next") or "/projects/"
+            if not next_url.startswith("/") or next_url in ("/", ""):
+                next_url = "/projects/"
+            out = Response("", status=302, headers={"Location": next_url})
+            # SameSite=None;Secure — required for cross-site iframe on huggingface.co
+            for name, value in sess.cookies.items():
+                out.set_cookie(
+                    name, value,
+                    path="/",
+                    max_age=1209600,
+                    samesite="None",
+                    httponly=(name == "sessionid"),
+                    secure=True,
+                )
+            return out
+
+        # Failure: wrong credentials — re-render login page with banner
+        err_html = r1.text if r1.text else ""
+        body_match = _re.search(r'(<body[^>]*>)', err_html, _re.IGNORECASE)
+        if body_match:
+            insert_pos = body_match.end()
+            err_html = err_html[:insert_pos] + _LOGIN_BANNER + err_html[insert_pos:]
+        else:
+            err_html = _LOGIN_BANNER + err_html
+        return Response(err_html, status=200, content_type="text/html; charset=utf-8")
+
     except requests.exceptions.ConnectionError:
         return _ls_unavailable()
     except Exception as e:
         return Response(f"Login error: {e}", status=502, content_type="text/plain")
 
-    # Success: LS redirects away from /user/login/
-    if r.status_code in (301, 302, 303, 307, 308):
-        next_url = request.args.get("next") or request.form.get("next") or "/projects/"
-        if not next_url.startswith("/") or next_url in ("/", ""):
-            next_url = "/projects/"
-        out = Response("", status=302, headers={"Location": next_url})
-        # 14-day session so a browser restart doesn't drop the cookie
-        for name, value in r.cookies.items():
-            out.set_cookie(
-                name, value,
-                path="/",
-                max_age=1209600,
-                samesite="Lax",
-                httponly=(name == "sessionid"),
-                secure=True,
-            )
-        return out
-
-    # Failure: wrong password or CSRF error — re-render login page with banner
-    err_html = r.text if r.text else ""
-    body_match = _re.search(r'(<body[^>]*>)', err_html, _re.IGNORECASE)
-    if body_match:
-        insert_pos = body_match.end()
-        err_html = err_html[:insert_pos] + _LOGIN_BANNER + err_html[insert_pos:]
-    else:
-        err_html = _LOGIN_BANNER + err_html
-    fwd = _out_headers(r, extra_exclude={"content-encoding", "content-length"})
-    return Response(err_html, status=200, headers=fwd, content_type="text/html; charset=utf-8")
-
 
 @app.route("/")
 def root_redirect():