Run localhost over TLS (so cookies still work)

[miketaylr]

Cookie “session” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. To know more about the “sameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

That would be a bummer.

[miketaylr]

Oh whoops, I forgot about this:

https://github.com/webcompat/webcompat.com/blob/793511d946e13b9883327f7e9ba1390cad60de4e/config/init.py#L160-L164

What this means is some point soon, these cookies might get rejected for local development and we'll need to have localhost served over TLS.

[miketaylr]

https://letsencrypt.org/docs/certificates-for-localhost/