{"id":7128,"date":"2023-10-24T16:29:14","date_gmt":"2023-10-24T08:29:14","guid":{"rendered":"https:\/\/i007.vip:15443\/wordpress\/?p=7128"},"modified":"2023-10-24T16:29:14","modified_gmt":"2023-10-24T08:29:14","slug":"disabling-hsts-for-localhost-on-chromium-based-browsers","status":"publish","type":"post","link":"https:\/\/i007.cc\/wordpress\/archives\/7128","title":{"rendered":"Disabling HSTS for localhost on Chromium-based browsers"},"content":{"rendered":"<header>\n<div class=\"z\">\n<div>\n<p><a href=\"https:\/\/www.meziantou.net\/disabling-hsts-for-localhost-on-chromium-based-browsers.htm\">cc from<\/a><\/p>\n<\/div>\n<div class=\"ab\"><\/div>\n<\/div>\n<\/header>\n<div>\n<p><a href=\"https:\/\/en.wikipedia.org\/wiki\/HTTP_Strict_Transport_Security\">Http Strict Transport Security (HSTS)<\/a>\u00a0is a security mechanism that instructs the browser to automatically redirect http requests to https before sending a request to the server. When you are developing a web application, you should disable HSTS for localhost. This is because enabling HSTS on localhost has implications for other applications. For instance, some applications start a local web server and open a browser. However, they cannot use a certificate, so they cannot use\u00a0<code>https<\/code>. If a website enables HSTS on\u00a0<code>localhost<\/code>\u00a0once, these applications won&#8217;t work as they are not listening on\u00a0<code>https<\/code>.<\/p>\n<aside class=\"h\">\n<p class=\"i\">Note<\/p>\n<p>ASP.NET Core is\u00a0<a href=\"https:\/\/github.com\/dotnet\/aspnetcore\/blob\/51fc6824e30016404964fc96a4a098a764bdbbfa\/src\/Middleware\/HttpsPolicy\/src\/HstsOptions.cs#L40-L45\">smart enough<\/a>\u00a0to not send the HSTS header when the application is running on localhost. However, this may not not be the case for other web frameworks.<\/p>\n<\/aside>\n<h2 id=\"clearing-hsts-policy\"><a class=\"j\" href=\"https:\/\/www.meziantou.net\/disabling-hsts-for-localhost-on-chromium-based-browsers.htm#clearing-hsts-policy\">#<\/a>Clearing HSTS policy manually<\/h2>\n<p>You can open the page\u00a0<code>about:\/\/net-internals\/#hsts<\/code>\u00a0in the browser and clear HSTS data for\u00a0<code>localhost<\/code>:<\/p>\n<p class=\"ai\"><picture><source srcset=\"\/assets\/delete-domain-security-policy.avif?v=43f4\" type=\"image\/avif\" \/><img loading=\"lazy\" decoding=\"async\" class=\"aj\" src=\"https:\/\/www.meziantou.net\/assets\/delete-domain-security-policy.png?v=4a53\" alt=\"\" width=\"1455\" height=\"722\" \/><\/picture><\/p>\n<aside class=\"h\">\n<p class=\"i\">Note<\/p>\n<p>You cannot use the policy\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/deployedge\/microsoft-edge-policies?WT.mc_id=DT-MVP-5003978#hstspolicybypasslist\">HSTSPolicyBypassList<\/a>\u00a0as it only applies to the preloaded list, not the dynamic list based on the\u00a0<code>Strict-Transport-Security<\/code>\u00a0header<\/p>\n<\/aside>\n<h2 id=\"using-another-domain\"><a class=\"j\" href=\"https:\/\/www.meziantou.net\/disabling-hsts-for-localhost-on-chromium-based-browsers.htm#using-another-domain\">#<\/a>Using another domain for development<\/h2>\n<p>HSTS is per domain. So, you can use another domain for development. For instance, you can use\u00a0<code>myapp.local<\/code>\u00a0instead of\u00a0<code>localhost<\/code>. This way, even if the app is using HSTS, it won&#8217;t affect other applications using\u00a0<code>localhost<\/code>. To set up a domain, you need to edit the HOSTS file:<\/p>\n<div class=\"ak\"><span class=\"al\">C:\\Windows\\System32\\drivers\\etc\\hosts<\/span><button id=\"cb3406870btn\" class=\"am\" type=\"button\">copy<\/button><\/div>\n<pre><code id=\"cb3406870\" class=\"\">127.0.0.1 myapp.local<\/code><\/pre>\n<p>Then, you can use\u00a0<code>https:\/\/myapp.local<\/code>\u00a0in your browser.<\/p>\n<p class=\"an\">Do you have a question or a suggestion about this post?\u00a0<a href=\"https:\/\/www.meziantou.net\/contact\">Contact me!<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>cc from Http Strict <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[24],"tags":[121],"class_list":["post-7128","post","type-post","status-publish","format-standard","hentry","category-value_docs","tag-05-"],"_links":{"self":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts\/7128","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/comments?post=7128"}],"version-history":[{"count":0,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/posts\/7128\/revisions"}],"wp:attachment":[{"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/media?parent=7128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/categories?post=7128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i007.cc\/wordpress\/wp-json\/wp\/v2\/tags?post=7128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}