From 8865b7398fc6ebc065fe439a0a8e9ea5264524bb Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 14 Sep 2026 23:47:49 +0000 Subject: [PATCH] Redirect the apex domain to www gratitext.app now resolves to the app too, but session cookies are host-scoped and search engines should see one origin, so 301 it to www.gratitext.app in the same middleware that forces HTTPS. Co-authored-by: Kent C. Dodds --- server/index.ts | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/server/index.ts b/server/index.ts index d683562..ea24a72 100644 --- a/server/index.ts +++ b/server/index.ts @@ -268,10 +268,19 @@ const getHost = (req: { get: (key: string) => string | undefined }) => // fly is our proxy app.set('trust proxy', true) -// ensure HTTPS only (X-Forwarded-Proto comes from Fly) +// The apex domain also points at this app, but sessions are cookie-scoped +// per host and search engines should see one origin, so send it to www. +const APEX_HOST = 'gratitext.app' +const CANONICAL_HOST = `www.${APEX_HOST}` + +// ensure HTTPS and the canonical host (X-Forwarded-Proto comes from Fly) app.use((req, res, next) => { const proto = req.get('X-Forwarded-Proto') const host = getHost(req) + if (host === APEX_HOST) { + res.redirect(301, `https://${CANONICAL_HOST}${req.originalUrl}`) + return + } if (proto === 'http') { res.set('X-Forwarded-Proto', 'https') res.redirect(`https://${host}${req.originalUrl}`)