5 ms·

It's worth noting that UAs can treat localhost, 127.0.0.1, etc. as secure even when they're visited over plain HTTP: https://w3c.github.io/webappsec-secure-con

It's worth noting that UAs can treat localhost, 127.0.0.1, etc. as secure even when they're visited over plain HTTP: https://w3c.github.io/webappsec-secure-contexts/#potentially-trustworthy-origin https://w3c.github.io/webappsec-secure-contexts/#potentially... Chrome (in the post's screenshots) follows this; I'm not sure about other UAs.

helloguillecl 8y ago
This does not work if you want to use a hostname other than "localhost" (for running VirtualHost) pointing to your local machine.
- devereaux 8y ago
  Open a world of fun by running your local services like proxies on 127.1.2.3, 127.2.3.4, etc with the matching hostnames in /etc/hosts You have 127.255.255.255 to play with!
  - Fnoord 8y ago
    You mean 127/8
    - prodimmune 8y ago
      There's nothing wrong with the previously used notation.
      - devereaux 8y ago
        127/8 may only be understandable to those who already know that the whole 127.255.255.255 range is reserved for localhost use. Sometimes being understandable is more important than using the most precise and shortest notation.
        Fnoord 8y ago
        127.255.255.255 is a broadcast address in the /8. It doesn't describe the amount of bits in the network. You need a netmask or CIDR notation for that. For IPv6 you need CIDR, so I suggest to learn that. CIDR is understandable for people who know basic networking. If someone doesn't understand what 127/8 means (which is totally OK if someone doesn't) I'd argue they shouldn't learn about the topic we discuss (valid HTTPS certs for localhost); they should learn something as basic as CIDR first. CIDR isn't difficult to understand. Basics first. You can't learn to speak English if you don't know how to open and close your mouth...
      - Fnoord 8y ago
        Yes, there is. Either you mention an IP address with a netmask such as 127.0.0.0 255.0.0.0 or you use CIDR. Mentioning a broadcast address to describe an address space is wrong because it doesn't describe how many bits (netmask and CIDR do that for IPv4).
sthottingal 8y ago
It is broken in Firefox since version 62 https://bugzilla.mozilla.org/show_bug.cgi?id=903966 https://bugzilla.mozilla.org/show_bug.cgi?id=903966
- runn1ng 8y ago
  It's not, the comment is mistaken, CORS is unrelated. But you need to use 127.0.0.1, not `localhost`
- jwatt 8y ago
  That's an old, long closed bug. I think the bug you want is https://bugzilla.mozilla.org/show_bug.cgi?id=1488740 https://bugzilla.mozilla.org/show_bug.cgi?id=1488740

helloguillecl 8y ago

This does not work if you want to use a hostname other than "localhost" (for running VirtualHost) pointing to your local machine.

devereaux 8y ago
Open a world of fun by running your local services like proxies on 127.1.2.3, 127.2.3.4, etc with the matching hostnames in /etc/hosts You have 127.255.255.255 to play with!
- Fnoord 8y ago
  You mean 127/8
  - prodimmune 8y ago
    There's nothing wrong with the previously used notation.
    - devereaux 8y ago
      127/8 may only be understandable to those who already know that the whole 127.255.255.255 range is reserved for localhost use. Sometimes being understandable is more important than using the most precise and shortest notation.
      - Fnoord 8y ago
        127.255.255.255 is a broadcast address in the /8. It doesn't describe the amount of bits in the network. You need a netmask or CIDR notation for that. For IPv6 you need CIDR, so I suggest to learn that. CIDR is understandable for people who know basic networking. If someone doesn't understand what 127/8 means (which is totally OK if someone doesn't) I'd argue they shouldn't learn about the topic we discuss (valid HTTPS certs for localhost); they should learn something as basic as CIDR first. CIDR isn't difficult to understand. Basics first. You can't learn to speak English if you don't know how to open and close your mouth...
    - Fnoord 8y ago
      Yes, there is. Either you mention an IP address with a netmask such as 127.0.0.0 255.0.0.0 or you use CIDR. Mentioning a broadcast address to describe an address space is wrong because it doesn't describe how many bits (netmask and CIDR do that for IPv4).

sthottingal 8y ago

It is broken in Firefox since version 62 https://bugzilla.mozilla.org/show_bug.cgi?id=903966 https://bugzilla.mozilla.org/show_bug.cgi?id=903966

runn1ng 8y ago
It's not, the comment is mistaken, CORS is unrelated. But you need to use 127.0.0.1, not `localhost`
jwatt 8y ago
That's an old, long closed bug. I think the bug you want is https://bugzilla.mozilla.org/show_bug.cgi?id=1488740 https://bugzilla.mozilla.org/show_bug.cgi?id=1488740