v154 · security · live probe
Security context inspector
Ask-before-HTTP exists to get every navigation into a secure context. This page reads its own security state — the real values, from this very load — and explains the one everyone trips over: http://localhost is a secure context, which is exactly why Balanced mode never warns on it.
This page, right now
reading…
- location.protocol
- —
- window.isSecureContext
- —
- location.hostname
- —
- location.origin
- —
Press a button, or read the verdict above — it was computed from the live values the moment the page loaded.
What this context unlocks
Powerful APIs are gated on isSecureContext. Each row below is a real presence check in this context — on an insecure page these go absent, which is the everyday cost Ask-before-HTTP is designed to end.
- probing…
Why localhost stays quiet
| Origin | isSecureContext | Warns before loading? |
|---|---|---|
https://example.com | true | no — already secure |
http://localhost:3000 | true — potentially trustworthy | no — exempt |
http://router (single-label) | false | no — HTTPS can't be expected |
http://192.168.1.1 | false | no — private address |
http://example.com | false | yes — this is the new ask |
The warning targets exactly the rows where a secure alternative is realistic: public hostnames. The others either already are trustworthy (localhost) or can never get a publicly-valid certificate, and Balanced mode leaves them alone — that restraint is what makes it shippable as a default. Strict mode (chrome://settings/security → Always Use Secure Connections → Strict, or the force_enabled policy value) warns on those too.
code path
// The two signals every page gets for free:
location.protocol // "http:" | "https:"
window.isSecureContext // true on https AND on http://localhost —
// "potentially trustworthy" includes loopback.
// How a subresource actually travelled (real evidence, not a guess):
const [entry] = performance.getEntriesByName(stylesheetURL);
entry.nextHopProtocol; // "h2", "h3", "http/1.1" — or "" when
// Timing-Allow-Origin hides it