Real HTTPS on *.localhost, and the Firefox catch
Cookies and Origin checks only behave like production if the hostnames do, so every local site gets real HTTPS from a local CA, except Firefox has its own idea about which CAs to trust.
Cookies and Origin checks only behave like production if the hostnames do, so every local site gets real HTTPS from a local CA, except Firefox has its own idea about which CAs to trust.