title: Rails not retaining session on second call when deployed to heroku
body: <p>I have created a Rails app that I'm using as api app (with an angular front end).  When I try to create a session on <code>SessionsController#create</code>, I am setting <code>session[:user_id]</code> and returning a user object.  My front end app is successfully getting this object and redirecting the browser to #/dashboard.  <code>DashboardComponent</code> has a guard that calls my <code>SessionsController#logged_in</code> which checks for a session in my rails app.  When I'm running locally, this works with no issues.  However, when deployed to Heroku, <code>session[:user_id]</code> is empty.  I'm not sure what I'm doing wrong. I know it's not a CORS or a CSRF issue because my client app gets the user object (I am logging it to the console).</p>
  <p>Here is my <code>initializers/session_store.rb</code></p>
  <pre><code>if Rails.env == &quot;production&quot;
    Rails.application.config.session_store :cookie_store, key: &quot;_myapp&quot;, domain: &quot;api-app.herokuapp.com&quot;
  else
    Rails.application.config.session_store :cookie_store, key: &quot;_myapp&quot;
  end
  </code></pre>
  <p>And just for fun, here's my <code>initializers/cors.rb</code></p>
  <pre><code>Rails.application.config.middleware.insert_before 0, Rack::Cors do
    allow do
      origins &quot;http://localhost:4200&quot;, &quot;https://angular-app.herokuapp.com&quot;
      resource &quot;*&quot;, 
        headers: :any, 
        methods: [:get, :post, :put, :patch, :delete, :options, :head], 
        credentials: true
    end
  end
  </code></pre>
  <p><code>SessionsController.rb</code></p>
  <pre><code>class SessionsController &lt; ApplicationController
      include CurrentUserConcern
    
      def create
        user = User
                .find_by(email: params[&quot;email&quot;])
                .try(:authenticate, params[&quot;password&quot;])
    
        if user
          session[:user_id] = user.id
          render json: user, status: :created
        else
          head :unauthorized
        end
      end
    
      def logged_in
        if @current_user
          render json: @current_user, status: :ok
        else
          head :no_content
        end
      end
    
      def logout
        reset_session
        head :no_content
      end
    end
  </code></pre>
  <p><code>current_user_concern.rb</code></p>
  <pre><code>module CurrentUserConcern
    extend ActiveSupport::Concern
  
    included do
      before_action :set_current_user, only: [:logged_in]
    end
  
    def set_current_user
      puts session[:user_id]
      if session[:user_id]
        @current_user = User.find(session[:user_id])
      end
    end
  end
  </code></pre>
  <p>I can provide any other code that might help</p>