Limiting access to heroku app

Question

I am using cloudflare to protect my heroku app, but users can still access the app directly via myapp.herokuapp.com , and there seems to be no way to delete the default domain name that heroku uses. How can I prevent direct access to the app, either by removing the default domain name or setting up some sort of whitelisting rules?

Answer 1

As is, heroku doesn't allow for the removal of the herokuapp.com domain for an app. However, they advise that if access to the app must exclusively be via a custom domain, then requests to the herokuapp.com destination could be redirected (301 redirect) to your custom domain URL.

It's mentioned in this note:

https://devcenter.heroku.com/articles/custom-domains