4 ms·
HSTS doesn’t apply to websites served by directly connecting to an IP address, right? (I couldn’t find any layman’s docs that said it in so many words, nor did
by jez 4y ago
HSTS doesn’t apply to websites served by directly connecting to an IP address, right?
(I couldn’t find any layman’s docs that said it in so many words, nor did I want to test it locally. My guess comes from a reading of section 8.1.1 in the HSTS RFC[1].)
I’ve been using 127.0.0.1:4000 or 0.0.0.0:4000 for local web development for a while now and have not really been held back.
Maybe people who have fancier local development setups can’t use an IP address for some reason and instead have to use localhost? But it seems to me like the easiest workaround is not to load some formatted plist file into chrome but rather to rewrite the address bar slightly.
[1] https://www.rfc-editor.org/rfc/rfc6797#section-8.1.1 https://www.rfc-editor.org/rfc/rfc6797#section-8.1.1
- oefrha 4y agoThat's correct, HSTS doesn't apply to IP literals. You can check with https://1.1.1.1/ https://1.1.1.1/. They would serve you an HSTS header: $ curl -sS -D- -o/dev/null https://1.1.1.1/ | grep -i strict-transport-security strict-transport-security: max-age=31536000 but you won't find 1.1.1.1 in chrome://net-internals/#hsts, and you can still directly request http://1.1.1.1/ http://1.1.1.1/, which returns a remote 301 response. Unlike for an HSTS domain, for which you get a local 307 response with a Non-Authoritative-Reason: HSTS header (in Chrome).
- deleted 4y ago[deleted]