Update app.py

app.py

@@ -12,7 +12,7 @@ import logging
 
 # --- Security Helper Functions ---
 def verify_origin(request: Request):
-    """Verify that the request comes from an allowed origin for /chat endpoint"""
+    """Simplified check since CORS middleware handles most cases"""
     origin = request.headers.get("origin")
     referer = request.headers.get("referer")
     
@@ -21,22 +21,17 @@ def verify_origin(request: Request):
         "https://www.chrunos.com"
     ]
     
-    # Allow localhost for development (you can remove this in production)
-    #if origin and any(origin.startswith(local) for local in ["http://localhost:", "http://127.0.0.1:"]):
-     #   return True
-    
-    # Check origin header
-    if origin in allowed_origins:
+    # If origin header exists, trust CORS middleware validation
+    if origin:
         return True
     
-    # Check referer header as fallback
+    # Fallback to referer check for non-CORS requests
     if referer and any(referer.startswith(allowed) for allowed in allowed_origins):
         return True
     
-    raise HTTPException(
-        status_code=403, 
-        detail="Access denied: This endpoint is only accessible from chrunos.com"
-    )
+    # If neither header present, log and deny
+    logger.info(f"No valid origin/referer - Origin: {origin}, Referer: {referer}")
+    raise HTTPException(status_code=403, detail="Access denied")
 
 # --- Configure Logging ---
 logging.basicConfig(level=logging.INFO)