v154 · security · illustrative walkthrough

Warning flow walkthrough

What actually happens between "user follows an http:// link" and "page on screen" in Chrome 154. The host classifier below is real, runnable logic mirroring the exemption rules; the interstitial step is an illustration — a page cannot embed or trigger Chrome's real warning UI, and this one does not pretend to.

Illustration, clearly labelled. The step-through models documented behaviour (HTTPS-Upgrades with its ~3s fallback timer, the Balanced-mode exemptions, the HttpsOnlyMode policy states). To see the real interstitial: in Chrome 154+, visit a public HTTP-only site, e.g. from chrome://settings/security → "Always Use Secure Connections". On older channels enable chrome://flags/#https-first-balanced-mode.

1 · Choose the navigation

Host classification (real logic, applied to your URL):

2 · Step through what Chrome does

    Press "Next step" to begin.

    the classifier, for real

    // Balanced mode skips the warning when HTTPS can't reasonably be
// expected. Mirrored from the Chromium behaviour:
function exemption(host) {
  if (host === "localhost" || host.endsWith(".localhost") ||
      host === "127.0.0.1" || host === "[::1]") return "loopback";
  if (!host.includes(".")) return "single-label";   // http://router
  if (isPrivateIPv4(host)) return "private-ip";     // 10/8, 172.16/12,
                                                    // 192.168/16, 169.254/16
  if (host.endsWith(".local")) return "mdns-local";
  return null;  // public host — the warning applies
}
// Plus: HttpAllowlist policy entries and hosts the user already
// clicked through ("Continue to site" is remembered).

    see also