I agree with some of the skeptical comments here, and wanted to add one more use case they are not thinking about: http://localhost:NNN/ http://localhost:NNN/

I agree with some of the skeptical comments here, and wanted to add one more use case they are not thinking about: http://localhost:NNN/ http://localhost:NNN/ There are many cases where you might want a service on localhost to be reachable via HTTP. Technically this should be exempt from https rules entirely, since who would the man in the middle be? If someone can MITM 127.0.0.1, they own your box already. It is impossible to get https certificates for localhost/127.0.0.1, making SSL with an approved cert impossible for local services.