diff --git a/index.js b/index.js
index 0879818..03d64fc 100644
--- a/index.js
+++ b/index.js
@@ -160,7 +160,7 @@ function fastifySession (fastify, options, next) {
 
       const cookieSessionId = getCookieSessionId(request)
       const saveSession = shouldSaveSession(request, cookieSessionId, saveUninitializedSession, rollingSessions)
-      const isInsecureConnection = session.cookie.secure === true && request.protocol !== 'https'
+      const isInsecureConnection = session.cookie.secure === true && request.protocol !== 'https' && request.hostname !== 'localhost'
       const sessionIdWithPrefix = hasCookiePrefix ? `${cookiePrefix}${session.encryptedSessionId}` : session.encryptedSessionId
       if (!saveSession || isInsecureConnection) {
         // if a session cookie is set, but has a different ID, clear it
diff --git a/lib/cookie.js b/lib/cookie.js
index 8a58845..3234305 100644
--- a/lib/cookie.js
+++ b/lib/cookie.js
@@ -25,10 +25,11 @@ module.exports = class Cookie {
     }
 
     if (this.secure === 'auto') {
-      if (request.protocol === 'https') {
+      if (request.protocol === 'https' || request.hostname === 'localhost') {
         this.secure = true
       } else {
         this.sameSite = 'lax'
+        this.partitioned = false
         this.secure = false
       }
     }
diff --git a/test/cookie.test.js b/test/cookie.test.js
index e0ad1bf..2e65efa 100644
--- a/test/cookie.test.js
+++ b/test/cookie.test.js
@@ -314,6 +314,7 @@ test('should use session cookie secure override when saving secure cookie', asyn
   t.after(() => { fastify.close() })
 
   const response = await fastify.inject({
+    authority: 'fastify-session.test',
     url: '/'
   })
 
@@ -361,6 +362,7 @@ test('should set session cookie secureAuto', async (t) => {
   t.after(() => { fastify.close() })
 
   const response = await fastify.inject({
+    authority: 'fastify-session.test',
     url: '/'
   })
 
@@ -388,6 +390,7 @@ test('should set session cookie secureAuto change SameSite', async (t) => {
   t.after(() => { fastify.close() })
 
   const response = await fastify.inject({
+    authority: 'fastify-session.test',
     url: '/'
   })
 
diff --git a/test/session.test.js b/test/session.test.js
index f93cdfa..ccec6e2 100644
--- a/test/session.test.js
+++ b/test/session.test.js
@@ -1365,6 +1365,7 @@ test('Override global options with regenerate', async t => {
   fastify.register(fastifyCookie)
   fastify.register(fastifySession, {
     ...DEFAULT_OPTIONS,
+    saveUninitialized: true,
     cookie: {
       secure: false,
       maxAge: 42,
diff --git a/test/util.js b/test/util.js
index f11c033..83f8d73 100644
--- a/test/util.js
+++ b/test/util.js
@@ -6,7 +6,7 @@ const fastifySession = require('..')
 const TestStore = require('./TestStore')
 
 const DEFAULT_SECRET = 'cNaoPYAwF60HZJzkcNaoPYAwF60HZJzk'
-const DEFAULT_OPTIONS = { secret: DEFAULT_SECRET }
+const DEFAULT_OPTIONS = { secret: DEFAULT_SECRET, saveUninitialized: false }
 const DEFAULT_SESSION_ID = 'Qk_XT2K7-clT-x1tVvoY6tIQ83iP72KN'
 const DEFAULT_ENCRYPTED_SESSION_ID = `${DEFAULT_SESSION_ID}.B7fUDYXU9fXF9pNuL3qm4NVmSduLJ6kzCOPh5JhHGoE`
 const DEFAULT_COOKIE_VALUE = `sessionId=${DEFAULT_ENCRYPTED_SESSION_ID};`