5 ms·
More importantly than that...if you need HSTS on localhost, you're doing something wrong. Add an exception in your code for HSTS on localhost, if it's required
by deaddodo 3y ago
More importantly than that...if you need HSTS on localhost, you're doing something wrong.
Add an exception in your code for HSTS on localhost, if it's required. Or, use a container and set up HSTS on its mounted IP.
- mschuster91 3y agoIt's not that anyone needs HSTS on localhost, just that it's damn easy to have your web app's backend accidentally pass out an HSTS header.
- rezonant 3y agoAnd it's not unreasonable to test a new HSTS implementation on localhost first, so I'm glad it works as it normally does. But there should be better tooling in devtools for this.
- deaddodo 3y agoIt's certainly not unreasonable to test software locally with HSTS (and other environmental configurations), sure. It just isn't good practice doing so on localhost, but instead in a jail or container with its own local network IP. Do you also test your crons, secure integrations and terminal configurations directly on your local environment as well? That just seems tedious, arduous and/or pollutative.
- dns_snek 3y agoYou don't need a jail or a container to change the origin, you can just add an entry in your hosts file that points to 127.0.0.1
- rezonant 3y agoWhat do you mean by secure integrations and terminal configurations? As for scheduled jobs, you would just test them during development by running them. It would be weird if the time span itself was inherent to your scheduled job behaving correctly. Of course in addition to automated testing.