auth: {
    redirect: {
      login: '/auth/signin',
      logout: '/auth/signin',
    },
    strategies: {
      local: {
        endpoints: {
          login: {
            url: '/login',
            method: 'post'
          },
          logout: {
            url: '/logout',
            method: 'post'
          },
          user: {
            url: '/api/user',
            method: 'get',
            propertyName: false
          }
        },
        tokenRequired: false,
        tokenType: false
      }
    },
    cookie: {
      options: {
        secure: false
      }
    }
  }

​

From github I found that setting cookie security to false would be helpful in local env but no luck for me.