4 ms·
Certainly there could be an exception for localhost right?
by tbrock 9y ago
Certainly there could be an exception for localhost right?
- collinmanderson 9y agoI'm curious about this myself. Would there be an attack vector? It seems to me secure localhost would only be needed for developers, and developers should be able to allow a self-signed cert.
- aurelian15 9y agoYes, there already is an exception for localhost. HTTP on localhost is considered a "secure context". Edit: To be more precise, and to quote [1] "Secure Contexts says UAs MAY treat localhost as a secure context only if they can guarantee it will only ever resolve to a loopback address (and are in any case not required to). https://w3c.github.io/webappsec-secure-contexts/#localhost" https://w3c.github.io/webappsec-secure-contexts/#localhost" [1] https://github.com/w3ctag/design-principles/pull/75#issuecomment-359518513 https://github.com/w3ctag/design-principles/pull/75#issuecom...