Other: Cannot login to local environment: missing CookieSecurePolicy.Always?

[szc126]

Website (required)

VocaDB

Describe the bug (required)

I had to add options.Cookie.SecurePolicy = CookieSecurePolicy.Always; to VocaDbWeb/Startup.cs for the login cookie (local dev environment) to be accepted.

local log:
[.NET ThreadPool Worker] WARN The cookie '.AspNetCore.Cookies' has set 'SameSite=None' and must also set 'Secure'.

browser console:

Cookie warnings 2
Cookie “XSRF-TOKEN” does not have a proper “SameSite” attribute value. Soon, cookies without the “SameSite” attribute or with an invalid value will be treated as “Lax”. This means that the cookie will no longer be sent in third-party contexts. If your application depends on this cookie being available in such contexts, please add the “SameSite=None“ attribute to it. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite token
Cookie “XSRF-TOKEN” does not have a proper “SameSite” attribute value. Soon, cookies without the “SameSite” attribute or with an invalid value will be treated as “Lax”. This means that the cookie will no longer be sent in third-party contexts. If your application depends on this cookie being available in such contexts, please add the “SameSite=None“ attribute to it. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite token

----

Cookie “.AspNetCore.Cookies” rejected because it has the “SameSite=None” attribute but is missing the “secure” attribute.

https://discord.com/channels/309072240639737866/1271565701601296506/1304288453952802887

Checklist (required)

Fill out the checklist. Use strikethroughs or leave fields empty if you don't know or are unable to check/test.

• Searched VocaDB/vocadb for duplicate issues.
• Tested on the beta site.
• Tested on different browsers (e.g. Firefox, Chrome, Safari, Edge).
• Checked in private mode.
• Cleared browser cache and cookies.
• Checked the DevTools console.
• Checked the syslog (mods+ only).