v154 · security

Ask before http on by default

Chrome 154 turns on Always Use Secure Connections in its Balanced configuration by default: before Chrome navigates to an insecure public http:// site, it asks first with a full-page warning. There is no JavaScript API here — this is browser navigation UX — so these demos probe what a page can honestly observe (its own security context, scheme, and subresource upgrade behaviour) and clearly label the rest as illustration.

concepts

  1. Security context inspector

    Live readouts of this very page's window.isSecureContext, scheme, origin, and the transport its own stylesheet actually travelled over — the exact signals a page has for reasoning about the world Ask-before-HTTP is pushing everyone into. Includes the localhost surprise: an http://localhost page is a secure context.

  2. HTTP subresource lab

    Attempt real http:// and https:// subresource loads from this page and read the real outcome — auto-upgraded, blocked, or loaded — via load/error events and the Resource Timing entry each attempt leaves behind. What happens depends on the scheme this page was served over, and the lab says which case you are in.

  3. Warning flow walkthrough

    Step through the decision Chrome makes on every navigation: HTTPS upgrade first, fallback timer, exemption checks (localhost, single-label hosts, private IPs, the HttpAllowlist policy), then the ask. The exemption classifier is real, runnable logic; the interstitial itself is clearly labelled illustration, because a page cannot embed the real one.

  4. HTTPS migration toolkit

    For site owners on the receiving end of the warning: build a valid Strict-Transport-Security header with live preload-eligibility validation, and generate the 301 redirect config for nginx, Apache, Express, or a Deno handler. Copy-ready output, validated as you type.

why it shipped

Chrome has been walking toward HTTPS-by-default for a decade: marking HTTP "Not secure" (2018), defaulting the omnibox to https (2021), silently attempting an HTTPS upgrade on every navigation with an HTTP fallback (HTTPS-Upgrades, 2023), and offering an opt-in strict HTTPS-Only mode. The remaining gap was the fallback itself — when the silent upgrade fails, Chrome would just load the plaintext HTTP site without telling anyone. Balanced mode closes that gap: the fallback now asks first on public sites, while staying quiet where HTTPS can't reasonably be expected — localhost, single-label intranet hosts, private IPs, and hosts the user or an admin has allowlisted.

Enterprises keep control via the HttpsOnlyMode policy (allowed · disallowed · force_enabled · force_balanced_enabled) and can exempt hosts with HttpAllowlist. Users can flip the same setting at chrome://settings/security.

what a page can and cannot observe

// Real, page-observable signals:
window.isSecureContext        // true on https:// AND on http://localhost
location.protocol             // "https:" or "http:"
performance.getEntriesByName(url)  // did a subresource load, and as what URL?

// NOT page-observable:
// - the Ask-before-HTTP interstitial (browser UI, pre-navigation)
// - whether the user clicked "Continue to site"
// - the HttpsOnlyMode enterprise policy value

Flags, for trying the behaviour on other channels: chrome://flags/#https-first-balanced-mode (the Balanced warning), chrome://flags/#https-first-mode-incognito, and the underlying silent upgrade is the HttpsUpgrades feature (--enable-features=HttpsUpgrades). The Chromium features behind the 154 default-on are HttpsFirstBalancedMode and HttpsFirstBalancedModeAutoEnable.

references