How to permanently exclude localhost from HSTS list in Google Chrome

Question

This is a followup question to Google Chrome redirecting localhost to https.

Does anyone know, how to permanently exclude localhost from HSTS list in Google Chrome?

Or, any other elegant solution that wouldn't require developer to visit chrome://net-internals/#hsts and delete localhost every time when switching from working on an HTTPS project to a different project on HTTP?

Answer 1

You can follow the solution here.

When Google Chrome keeps redirecting your localhost Url from http://localhost to https://localhost, do the following:

1. Open the Developer Tools panel (CTRL+SHIFT+I)
2. Click and hold the reload icon
3. A menu will open
4. Choose the 3rd option from this menu (“Empty Cache and Hard Reload”)

Answer 2

Update:

You can install a proper SSL certificate for those domains if you want to for free, so you won't need to mess around with HSTS. Take a look here.

---

You may edit your system's hosts file:

• On Windows: C:\Windows\System32\drivers\etc\hosts
• On Linux: /etc/hosts

In there you can define a different domain for each project:

 127.0.0.1    project1.local
 127.0.0.1    project2.local
 127.0.0.1    projectN.local

Note: I'm using *.local domains (you can use virtually anything) because you have already set localhost to redirect to https, and such we have to use a different domain. Although I strongly recommend you to install a real SSL certificate and reset to default any modifications you have made on HSTS.

Once saved, when you navigate to those domain in any browser it will load from 127.0.0.1 (localhost). If you use apache/nginx as server you optionally can define VirtualHosts for each domain also so you don't need to change your httpd folder every time you switch projects.

Then of course you will have to re-issue any certificate that you may have for those projects for the new domains, but those would be unique for each project. And on Chrome you would not need to be messing net-internals more than once for each domain for the projects which you don't have a certificate (and 0 times for those with certificate).

Answer 3

Chrome 78 supports a policy called HSTSPolicyBypassList. You can list "localhost" as a domain to bypass HSTS. To configure Chrome policy on Linux, just create a file at /etc/opt/chrome/policies/managed/policies.json with the following content:

{
    "HSTSPolicyBypassList": [
        "localhost"
        ]
}

You can see the policies loaded by Chrome, typing chrome://policy/ at address bar.

Answer 4

Not a permanent fix (security issue can be involved)

I found a "fix". Something interesting, but cannot be a permanent fix because it can cause multiple security issues.

Here's what I did:

1. Open Google Chrome
2. In the Search Bar type chrome://flags/#allow-insecure-localhost
3. Enabled Allow invalid certificates for resources loaded from localhost.

If you reload your application, the warning should be gone.

PS I did that because I needed to recreate a certification but didn't have the time. That's why I did that. I'll turn off this when my certification will work locally.

Answer 5

I got sick of deleting localhost from chrome://net-internals/#hsts , so I learned how to create a profile for macOS that sets two Chrome policies: HSTSPolicyBypassList + CertificateTransparencyEnforcementDisabledForURLs

Here is a repo with the installable profile for macOS that configures the policy, along with notes on why defaults write com.google.Chrome HSTSPolicyBypassList -string "localhost" doesn't work. https://github.com/ip2k/I-Dont-Care-About-HSTS-For-Localhost

Additionally, chrome://flags/#allow-insecure-localhost and https://chromedevtools.github.io/devtools-protocol/tot/Security/#method-setIgnoreCertificateErrors might be interesting for people working with this frequently or in headless environments. I've added links in the aforementioned repo to anything relevant I could find about this as well. PRs welcome!

Answer 6

For Brave Windows users, you need to add it like this via Registry Editor, under Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\BraveSoftware\Brave\HSTSPolicyBypassList, with key 100 and value localhost:

And you can verify that it's working under brave://policy.