localhost is also a secure origin by browsers

Also partitioned cookies are only allowed with secure, so in `secure: 'auto'` also set partitioned to false

Author: segevfiner

lib/cookie.js

@@ -25,10 +25,11 @@ module.exports = class Cookie {
     }
 
     if (this.secure === 'auto') {
-      if (request.protocol === 'https') {
+      if (request.protocol === 'https' || request.hostname === 'localhost') {
         this.secure = true
       } else {
         this.sameSite = 'lax'
+        this.partitioned = false
         this.secure = false
       }
     }

lib/fastifySession.js

@@ -166,7 +166,7 @@ function fastifySession (fastify, options, next) {
 
       const cookieSessionId = getCookieSessionId(request)
       const saveSession = shouldSaveSession(request, cookieSessionId, saveUninitializedSession, rollingSessions)
-      const isInsecureConnection = cookieOpts.secure === true && request.protocol !== 'https'
+      const isInsecureConnection = cookieOpts.secure === true && request.protocol !== 'https' && request.hostname !== 'localhost'
       const sessionIdWithPrefix = hasCookiePrefix ? `${cookiePrefix}${session.encryptedSessionId}` : session.encryptedSessionId
       if (!saveSession || isInsecureConnection) {
         // if a session cookie is set, but has a different ID, clear it