v132 · security

Ignore Strict-Transport-Security for localhost

Strict-Transport-Security response headers can cause problems for localhost web servers because STS applies host-wide, across all ports. This causes compatibility problems for web developers testing locally as well as end-users who use software packages that commonly spin up localhost webservers for ephemeral reasons (e.g. communication of an auth token from

concepts

  1. HSTS on localhost

    HSTS no longer applies on localhost. Local dev that hit an HSTS-pinned domain previously can run http again.

  2. dev workflow

    The motivating papercut, replayed: TLS server then HTTP server on the same localhost, pre-132 vs 132+ timelines.

  3. before / after flow

    Step-through of http://localhost:8080 visit. Pre-v132 fails at the upgrade step; v132+ exempts at the STS check.

  4. loopback host probe

    Type any hostname; the page tells you whether Chrome considers it loopback for STS exemption. Plus the eight canonical examples (including the localhost.evil.com trap).

why it shipped

Strict-Transport-Security response headers can cause problems for localhost web servers because STS applies host-wide, across all ports. This causes compatibility problems for web developers testing locally as well as end-users who use software packages that commonly spin up localhost webservers for ephemeral reasons (e.g. communication of an auth token from

references