The plugin has code:

/* On insecure connections, remove `secure` attribute from remote cookies */
const setCookies = remoteRes.headers['set-cookie']
if (!ctx.req.socket.encrypted && !lws.config.rewriteKeepSecureAttr && setCookies && setCookies.length) {
  const cookies = setCookies.map(c => util.removeCookieAttribute(c, 'secure'))
  remoteRes.headers['set-cookie'] = cookies
}

If secure attribute is removed but there is "SameSite=None" a browser rejects cookie, breaking all login pages. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie for exact error message in a browser DevTools:

Cookie "myCookie" rejected because it has the "SameSite=None" attribute but is missing the "secure" attribute.
This Set-Cookie was blocked because it had the "SameSite=None" attribute but did not have the "Secure" attribute, which is required in order to use "SameSite=None".

Consider removing SameSite=None together with secure. Other values of SameSite are safe without secure.