demo · v132

Which hosts is "localhost" for STS purposes?

Type a hostname and see whether Chrome 132 considers it loopback for STS exemption. The rules: the literal string localhost, any IPv4 in 127.0.0.0/8, ::1, and any subdomain of .localhost.

canonical examples

localhostliteral hostnameEXEMPT
api.localhost.localhost subdomainEXEMPT
api.local.local mDNS — NOT localhostapplies
127.0.0.1loopback IPv4EXEMPT
127.0.0.42any 127/8 IPv4EXEMPT
::1loopback IPv6EXEMPT
192.168.1.5private RFC-1918applies
localhost.evil.com"localhost" as a subdomain — NOT loopbackapplies
// the check, in pseudocode
function isLoopback(host) {
  if (host === "localhost") return true;
  if (host.endsWith(".localhost")) return true;
  if (host === "::1") return true;
  // 127.0.0.0/8
  if (/^127\.\d+\.\d+\.\d+$/.test(host)) return true;
  return false;
}

see also