How do I solve "Middleware "strapi::session": App keys are required" error in my deployment of Strapi to Heroku?

Question

I'm following the official instructions to deploy my strapi starter app to Heroku. The app runs fine locally. The only thing I left out in my deployment instructions were installing the PG node module (it is already installed because my local app uses Postgresql).

Accessing the Heroku logs, I see this:

error: Middleware "strapi::session": App keys are required. 
Please set app.keys in config/server.js (ex: keys: ['myKeyA', 'myKeyB'])

Maybe this is an important detail: I followed this process once, and everything worked. I was able to deploy to Heroku. I tried it again and it didn't work. I was thinking maybe Heroku had a problem with me re-using an app name, but I tried to name the app something different in Heroku and I still had the same error.

Is heroku looking in the wrong place for my server.js file? Should it be looking in my "./config/env/production" folder instead of my "./config" folder?

Per the instructions, here is my ./config/env/production/database.js

const parse = require('pg-connection-string').parse;
const config = parse(process.env.DATABASE_URL);

module.exports = ({ env }) => ({
  connection: {
    client: 'postgres',
    connection: {
      host: config.host,
      port: config.port,
      database: config.database,
      user: config.user,
      password: config.password,
      ssl: {
        rejectUnauthorized: false
      },
    },
    debug: false,
  },
});

Here is my ./config/env/production/server.js

module.exports = ({ env }) => ({
    url: env('MY_HEROKU_URL'),
});

And here is my ./config/server.js

module.exports = ({ env }) => ({
  host: env('HOST', '0.0.0.0'),
  port: env.int('PORT', 1337),
  app: {
    keys: env.array('APP_KEYS'),
  },
});

my package.json for good measure:

{
  "dependencies": {
    "@strapi/plugin-graphql": "^4.0.0",
    "@strapi/plugin-i18n": "4.0.6",
    "@strapi/plugin-users-permissions": "4.0.6",
    "@strapi/strapi": "4.0.6",
    "lodash.set": "^4.3.2",
    "pg": "8.6.0",
    "pg-connection-string": "^2.5.0"
  },
  "name": "backend",
  "private": true,
  "version": "0.1.0",
  "description": "A Strapi application",
  "scripts": {
    "develop": "strapi develop",
    "start": "strapi start",
    "build": "strapi build",
    "strapi": "strapi"
  },
  "devDependencies": {},
  "author": {
    "name": "A Strapi developer"
  },
  "strapi": {
    "uuid": "f64b509e-2d95-4464-8d39-d6f0d1c7a31a",
    "template": "@strapi/template-corporate@^1.0.0",
    "starter": "@strapi/starter-next-corporate"
  },
  "engines": {
    "node": ">=12.x.x <=16.x.x",
    "npm": ">=6.0.0"
  },
  "license": "MIT"
}

I'm running Node v14.18.3 and NPM v6.14.15

Answer 1

I solved it with this in ./config/env/production/server.js

module.exports = ({ env }) => ({
  url: env("MY_HEROKU_URL"),
  proxy: true,
  app: {
    keys: env.array("APP_KEYS", ["testKey1", "testKey2"]),
  },
});

testKey1, testKey2 are just placeholders and need to be replaced by 2 random keys via CONFIG VAR in heroku

APP_KEYS=someSecret,anotherSecret

proxy: true was also important. Else it throws a Cannot send secure cookie over unencrypted connection

Answer 2

Adding the environment variables to your file as @Temo mentioned is not the right solution. Although it works it poses quite some security threats.

What you should do is add the APP_KEYS to your environment variables on Heroku. You can generate a new key by creating a file with this code:

// filename: generateCode.js
const crypto = require('crypto')
console.log(crypto.randomBytes(16).toString('base64'))

and then running it from the console with:

node generateCode.js

The code it generates looks something like foP7OJcuRhCw1sTR6EfZPw==. Use that as your APP_KEY in Heroku.