secure cookies node.js + Heroku + CloudFlare

Question

I've looked at this answer and this answer but no dice. My problem is that when my app is accessed through https://appname.herokuapp.com, everything works fine. but when accessed through https://www.appname.com (which CloudFlare aliases to https://appname.herokuapp.com), it breaks down.

Specifically, when a user logs in, the authentication is processed correctly, but the user session cookie is not set properly. So when the logged-in user is forwarded to the next screen, the request gets rejected as unauthorized.

Right now I am doing this in express:

var mySession = session({
    key: "sid",
    secret: process.env.SESSIONS_SECRET,
    proxy: true,
    cookie: {
        maxAge: 86400000,
        secure: true,
    },
    store: rDBStore,
    resave: false,
    saveUninitialized: true,
    unset: 'destroy'
});

app.enable('trust proxy');
app.use(mySession);

Am I missing something in my node code, or in my CloudFlare settings?

Answer 1

Could it possibly be related to that CloudFlare puts the node app instanece behind a proxy?

Quoted from expressjs/session documentation:

If you have your node.js behind a proxy and are using secure: true, you need to set "trust proxy" in express.

app.set('trust proxy', 1)

https://github.com/expressjs/session#cookiesecure