update

app.py

@@ -82,12 +82,12 @@ app.secret_key = os.environ.get("FLASK_SECRET_KEY", "dev-secret-please-change")
 
 from werkzeug.middleware.proxy_fix import ProxyFix
 
-app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1, x_port=1, x_prefix=1)
+app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1)
 # supaya session tersimpan di browser saat lewat proxy/HTTPS (HF Spaces)
 app.config.update(
     SESSION_COOKIE_NAME="session",
     SESSION_COOKIE_SAMESITE="None",
-    SESSION_COOKIE_SECURE=False,
+    SESSION_COOKIE_SECURE=True,
     SESSION_COOKIE_HTTPONLY=True,
     SESSION_COOKIE_PATH="/",
     PREFERRED_URL_SCHEME="https",
@@ -434,11 +434,14 @@ def auth_logout():
 def about():
     return render_template("about.html")
 
+
 @app.route("/subjects")
 @login_required
 def subjects():
+    log.info(f"[SESSION DEBUG] logged_in={session.get('logged_in')} user_id={session.get('user_id')}")
     return render_template("home.html", subjects=SUBJECTS)
 
+
 @app.route("/chat/<subject_key>")
 @login_required
 def chat_subject(subject_key: str):