3 ms·
Remember than any page in your browser can run scripts from your computer. Browsers have a security model of what is allowed or not, that is a huge super-compli
by user5994461 9y ago
Remember than any page in your browser can run scripts from your computer. Browsers have a security model of what is allowed or not, that is a huge super-complicated mess. One of the protection is blocking mixed http and https.
localhost and 127.0.0.1 never get exceptions to security rules, including mixed content.
The rational is that there are many intranet and local applications that might be accessible on 127.0.0.1, they were not designed or secured to be accessible from the internet.
- xg15 9y agoI don't think that really makes sense in that context. The current situation is that you can happily access localhost from unencrypted sites - even though those sites are more likely to contain malicious code. Additionally, localhost services are treated as a separate origin, so if a service is non-cooperating, you can only send fire-and-forget GETs which reduces the attack surface considerably.