Update src/index.js

src/index.js

@@ -38,12 +38,18 @@ app.use(
     maxAge: 30 * 24 * 60 * 60 * 1000,
     keys: [process.env.COOKIE_KEY],
 
+    sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax', 
+    
+    // Secure MUST be true if sameSite is 'none'
+    secure: process.env.NODE_ENV === 'production', 
+    
+    // Allow proxy trust (HuggingFace uses a proxy)
     httpOnly: true,
-    secure: process.env.NODE_ENV === 'production',
-    sameSite: 'lax',
   })
 );
 
+// Trust the HuggingFace/Cloudflare proxy so 'secure' cookies work
+app.set('trust proxy', 1);
 
 app.use((req, res, next) => {
     if (req.session && !req.session.regenerate) {
@@ -78,4 +84,4 @@ initSocket(httpServer); // Initialize Socket
 const PORT = process.env.PORT || 3000;
 httpServer.listen(PORT, () => { // Listen on httpServer, NOT app
   console.log(`🚀 Server + Socket running on port ${PORT}`);
-});
+});