Question

I have a Flask application hosted on Heroku, and the Heroku instance (say, “helloworld.herokuapp.com“) has a custom domain name, say “www.helloworld.com“.

When I access the app at the native heroku URL, sessions work perfectly fine. When I access it at www.helloworld.com, they don’t work. I assume that this is because the session cookie that Flask is signing is for the wrong domain.

I tried assigning app.SESSION_COOKIE_DOMAIN and app.SERVER_NAME to ‘helloworld.com‘, but it still only signs the session cookies for helloworld.herokuapp.com.

Is there any way I can force the session cookies to sign as my custom domain?

Answer 1

After much testing and many permutations of SESSION_COOKIE_DOMAIN and SERVER_NAME, I concluded that the problem was with Heroku. Something about the way Heroku currently routes/hooks up to custom domains breaks domain cookies.

I verified this by moving to EC2…now everything works.