Update setup-hf-config.mjs

setup-hf-config.mjs

@@ -242,12 +242,24 @@ function applyEnvPatches(config, tgToken) {
     ? { mode: "token",    token:    gatewayToken    }
     : { mode: "password", password: gatewayPassword };
 
-  // Control UI flags required for HF Spaces iframe embedding
-  config.gateway.controlUi = config.gateway.controlUi || {};
-  config.gateway.controlUi.allowInsecureAuth                        = true;
-  config.gateway.controlUi.allowedOrigins                           = ["*"];
-  config.gateway.controlUi.dangerouslyDisableDeviceAuth             = true;
-  config.gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback = true;
+// Control UI security configuration
+config.gateway.controlUi = config.gateway.controlUi || {};
+
+// Remove retired and unsafe legacy options
+delete config.gateway.controlUi.dangerouslyDisableDeviceAuth;
+delete config.gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback;
+
+// HTTPS is provided by Hugging Face Spaces
+delete config.gateway.controlUi.allowInsecureAuth;
+
+// Restrict browser origin to this Space
+if (SPACE_HOST) {
+  config.gateway.controlUi.allowedOrigins = [
+    "https://" + SPACE_HOST
+  ];
+} else {
+  delete config.gateway.controlUi.allowedOrigins;
+}
 
   // Always refresh trusted proxies (HF pod IPs can change)
   config.gateway.trustedProxies = trustedProxies;