On: Changes to SameSite Cookie Behavior – A Call to Action for Web Developers

[blickentwapft]

Please browser developers just make it easy to switch requirements for HTTPS off during development.

There’s any number of circumstances in which my development machines don’t have HTTPS.

[VWWHFSfQ → blickentwapft]

This is so annoying. Our app requires HTTPS when not in debug mode. If you run the app locally and accidentally forget to turn on debugging then it will try to redirect to HTTPS. Firefox sees this and then from then on tries to force HTTPS, even after you've restarted the app with debugging. And now you simply can't access the non-HTTPS local site and I have no idea how to make Firefox forget about the HTTPS redirect. Infuriating.

[danielhlockard → VWWHFSfQ]

Clear it from your HSTS cache, I bet you're setting that in the app when https is hit.

[VWWHFSfQ → danielhlockard]

It's not HSTS. I've tried multiple methods to clear localhost from Firefox HSTS cache and it's not in there. But it still forces the HTTPS redirect.

[iggldiggl → VWWHFSfQ]

301 cache then?

[marksomnian → blickentwapft]

With Chrome you can go to chrome://flags, find “unsafely treat insecure origins as secure”, and allowlist your dev server.

[joewrong → blickentwapft]

This may help https://github.com/FiloSottile/mkcert

[Nextgrid → blickentwapft]

Maybe there just needs to be better tooling around generating certificates or the "invalid certificate" warning should be toned down.

[Avamander → blickentwapft]

Set up local nginx reverse proxy, test and develop in production-like environment. It's really not hard.