Yes, there already is an exception for localhost. HTTP on localhost is considered a "secure context". Edit: To be more precise, and to quote [1] "Secure Conte

Yes, there already is an exception for localhost. HTTP on localhost is considered a "secure context". Edit: To be more precise, and to quote [1] "Secure Contexts says UAs MAY treat localhost as a secure context only if they can guarantee it will only ever resolve to a loopback address (and are in any case not required to). https://w3c.github.io/webappsec-secure-contexts/#localhost" https://w3c.github.io/webappsec-secure-contexts/#localhost" [1] https://github.com/w3ctag/design-principles/pull/75#issuecomment-359518513 https://github.com/w3ctag/design-principles/pull/75#issuecom...