I don't think so.

I don't think always sent secure cookies to the client that pretend to be https is a wrong idea.

Even if the next hop is not a trust proxy, sending secure cookies should not harm. Secure cookies will not set when the end client (broswer) is using http.

That was what I thought... but the reason I approved anyway is trustProxy wasn't respected at the end of the day...

I could accept the following:

if (opts.secure === 'auto') {
    if (reply.request.protocol === 'https' || (fastify.trustProxy === true && request.headers['x-forwarded-proto'] === 'https')) {
      opts.secure = true
    } else {
      opts.sameSite = 'lax'
    }
}

However, should be noted that x-forwarded-proto is not the standard, Forwarded is

fastify.trustProxy === true && request.headers['x-forwarded-proto'] === 'https')

This is the same as reply.request.protocol === 'https' AFAICT since it check trustProxy and uses the header if it's available.