Setting HTTP-only cookies for session based auth (React SPA + Python backend)

Thank you for your help, I have redeployed my frontend and everything is working as expected.

Now I am trying to query backend application (hostname: https://playlist-mood-evaluator-api.fly.dev) that is registered through Cloudfare’s DNS at api.playlistmoodevaluator.com, a subdomain of my playlistmoodevaluator.com domain. I have configured everything as we have discussed!

The problem: my frontend is seemingly unable to reach my backend at api.playlistmoodevaluator.com. I’ve attached a screenshot of the failed request:

The error in the console is as follows: (Reason: CORS request did not succeed). Status code: (null).

There is also the missing HTTPS symbol, indicating that my backend is not encrypted with TLS? Do I just need to add a cert to my backend application, which is expecting HTTPS?

My app is accessible from its original Fly URL, but the browser tells me the subdomain that I registered at Cloudfare is not HTTPS. Is this an error in my configuration for Cloudfare and my subdomain, or the config for my backend app deployed on Fly io that my subdomain routes to?

EDIT:

Added the certificate via Fly dashboard, registered to my subdomain. Everything works as intended. I should have just trusted my gut instinct instead of asking first!

Thanks for your help along the way.