add trust proxy to fix cookies

apps/backend/src/controllers/users.ts

@@ -13,7 +13,9 @@ export async function register(
     const body = schemas.users.registration.parse(req.body);
 
     if (body.email !== "alex@alexav.gg") {
-      res.status(400).json({ message: "You are not authorized to register" });
+      return res
+        .status(400)
+        .json({ message: "You are not authorized to register" });
     }
 
     const email = body.email;

apps/backend/src/index.ts

@@ -23,6 +23,13 @@ const redisClient = createClient({ url: env.REDIS_URL });
 redisClient.connect().catch(console.error);
 
 const app = express();
+
+// TLS terminates at Traefik and the SSR frontend proxies onward over plain
+// HTTP, so req.protocol is "http" here and the session cookie's `secure` flag
+// would silently suppress Set-Cookie. Trusting X-Forwarded-Proto restores it.
+// The only reachable client is that proxy, on an internal network.
+app.set("trust proxy", true);
+
 app.use(express.urlencoded({ extended: false }));
 app.use(express.json());