Try trust proxy

web/src/server.ts

@@ -38,10 +38,8 @@ const createSapperServer = async (): Promise<Express> => {
     app.use(
         session({
             secret: key,
-            // secureProxy: !dev,
             name: "session",
             secure: !dev,
-            httpOnly: !dev,
             domain: ENV.WEB_DOMAIN,
         }),
         compression({ threshold: 0 }),
@@ -51,6 +49,7 @@ const createSapperServer = async (): Promise<Express> => {
             }),
         }),
     );
+    app.set("trust proxy", true);
 
     return app;
 };