follow cursor

app.py

@@ -8,10 +8,16 @@ app = FastAPI()
 app.add_middleware(
     CORSMiddleware,
     allow_origins=["https://ancient-time-545042.framer.app"],
-    # allow_origins=["*"],
     allow_credentials=True,
-    allow_methods=["GET", "POST", "HEAD", "OPTIONS"],
-    allow_headers=["Access-Control-Allow-Headers", 'Content-Type', 'Authorization', 'Access-Control-Allow-Origin']
+    allow_methods=["GET", "POST", "OPTIONS"],
+    allow_headers=[
+        "Content-Type", 
+        "Authorization",
+        "Access-Control-Allow-Credentials",
+        "Access-Control-Allow-Origin",
+        "Access-Control-Allow-Headers",
+    ],
+    expose_headers=["Set-Cookie"]
 )
 
 @app.get("/")
@@ -22,29 +28,31 @@ def greet_json(request: Request):
     })
     return response
 
-@app.options("/auth")
-async def auth_options():
-    return Response(status_code=200)
-
 @app.post("/auth")
-async def auth(request: Request, response: Response):
+async def auth(request: Request):
     data = await request.json()
     if data.get("username") == "admin" and data.get("password") == "password":
+        # Create response
+        response = JSONResponse(
+            content={"message": "Authentication successful"},
+            status_code=200
+        )
+        
+        # Set cookie with correct parameters for cross-origin
         response.set_cookie(
             key="comfy_session",
             value="dummy_session_value",
             httponly=True,
-            secure=True,  # Required for HTTPS
+            secure=True,
             samesite="none",  # Required for cross-origin
-            domain=".framer.app"  # Match your domain
+            # Don't set domain to allow the cookie to be set on the Framer domain
+            max_age=1800,  # 30 minutes
+            path="/"
         )
-        return {"message": "Authentication successful"}
+        
+        return response
     raise HTTPException(status_code=401, detail="Invalid credentials")
 
-@app.options("/protected")
-async def protected_options():
-    return Response(status_code=200)
-
 @app.get("/protected")
 def protected_route(comfy_session: Optional[str] = Cookie(None)):
     if comfy_session != "dummy_session_value":