demo · v132

Visiting localhost:8080 over HTTP

Same flow, two Chrome versions. Pre-v132: an STS header from a remote site for the localhost host caused HTTP-to-localhost to upgrade and fail. v132+: localhost is exempt.

spec excerpt

// chromium net/http/transport_security_state.cc (after v132)

if (host == "localhost" ||
    IPAddress::IsLoopback(ip) ||
    host.ends_with(".localhost")) {
  // STS does not apply to localhost
  return false;
}

// otherwise, proceed with normal STS check
return CheckPin(domain_state, host_for_check);

see also