Upload app.py

app.py

@@ -18,6 +18,7 @@ from datetime import datetime, timezone
 
 from dotenv import load_dotenv
 from flask import Flask, request, jsonify, render_template, session
+from werkzeug.middleware.proxy_fix import ProxyFix
 
 import database
 import stt
@@ -33,10 +34,13 @@ AUDIO_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "static", "
 def create_app():
     flask_app = Flask(__name__)
     flask_app.secret_key = os.environ["SECRET_KEY"]
-    # Hugging Face Spaces (and most production hosts) serve over HTTPS via a
-    # reverse proxy. Without these two flags the browser drops the session
-    # cookie on cross-request navigation, so session["user_id"] is missing
-    # when /history is called and the consultation tab shows nothing.
+    # Hugging Face Spaces (and Render) sit behind a reverse proxy that
+    # terminates HTTPS and forwards requests to gunicorn as plain HTTP.
+    # Without ProxyFix, Flask sees every request as HTTP, which means
+    # SESSION_COOKIE_SECURE=True would silently stop Flask from ever
+    # sending the session cookie. ProxyFix reads X-Forwarded-Proto so
+    # Flask correctly treats the request as HTTPS end-to-end.
+    flask_app.wsgi_app = ProxyFix(flask_app.wsgi_app, x_for=1, x_proto=1, x_host=1)
     flask_app.config["SESSION_COOKIE_SECURE"] = True
     flask_app.config["SESSION_COOKIE_SAMESITE"] = "Lax"
     os.makedirs(AUDIO_DIR, exist_ok=True)