I develop applications on my local computer that I later deploy to a TLS production server. Should I develop with TLS on or off?
The answer is simple - yeah, dev using TLS. Here's why:
- You need to set the secure flag on cookies
- You want to make sure all resources accessed are https
- You might forget to turn on TLS dependencies when you deploy your code to production
- It's easy to do this. Go use acme.sh to register a let's encrypt cert using DNS for domain verification. Create a DNS A record that points to 127.0.0.1. Done.
- Don't use self signed certs because I don't want you forming a habit of clicking past TLS warnings
If you really really don't want to....
Then you need a post deploy compensating control. That means scan your website looking for TLS dependancies like the cookie secure flag. Use qualys free scanner to probe your site for issues like this.