login fix

app.py

@@ -19,20 +19,16 @@ def _safe_json_schema_to_python_type(schema, defs=None):
     return _orig_json_schema_to_python_type(schema, defs)
 _gc_utils._json_schema_to_python_type = _safe_json_schema_to_python_type
 
-# Gradio's LoginButton navigates the iframe with window.location.assign, which causes
-# cross-origin cookie issues in Safari and infinite redirect loops in incognito mode.
-# Patching the JS to navigate window.top (the top-level tab) instead fixes both.
-import json as _json
+# HF Spaces embeds the app in an iframe. Gradio's LoginButton uses window.location.assign()
+# which navigates the iframe itself, causing cookie issues in Safari and redirect loops in
+# incognito. HF docs recommend using target=_blank to open OAuth in a new tab instead.
 import gradio.components.login_button as _login_btn_mod
 _login_btn_mod._js_handle_redirect = """
 (buttonValue) => {
     const path = buttonValue === BUTTON_DEFAULT_VALUE ? '/login/huggingface' : '/logout';
     const url = window.location.origin + path + window.location.search;
     window.parent?.postMessage({ type: "SET_SCROLLING", enabled: true }, "*");
-    setTimeout(() => {
-        try { (window.top || window).location.assign(url); }
-        catch (e) { window.location.assign(url); }
-    }, 500);
+    setTimeout(() => { window.open(url, '_blank'); }, 500);
 }
 """