Https-everywhere: Don't mess with localhost URLs

Created on 24 Jan 2017 · 11Comments · Source: EFForg/https-everywhere

With "block all unencrypted requests" enabled, HTTPS Everywhere tries to rewrite localhost URLs to use HTTPS, which is unideal. We probably shouldn't do that.

Also relevant: https://www.w3.org/TR/secure-contexts/#localhost

Source

strugee

Most helpful comment

+1 👍 - For all the web developers out there.

exegete46 on 18 Feb 2017

👍4

All 11 comments

+1 👍 - For all the web developers out there.

exegete46 on 18 Feb 2017

👍4

+1
Really annoying that it messes with localhost

Kibouo on 21 Feb 2017

Affects both, http://127.0.0.1:<PORT> as well as http://localhost:<PORT>.
Pretty annoying.

Ryuno-Ki on 2 Mar 2017

https://github.com/EFForg/https-everywhere/blob/9a243c6cd71f612a5b539c83f59a469eb5950fae/rewriter/rewriter.js#L69 looks like the line in question.

At this point I would long have changed the regex to use RegExp … so it is possible to break it into smaller part, concatenate it and pass it to new RegExp().

Ryuno-Ki on 2 Mar 2017

Please stop commenting with +1s; it generates a lot of spam for subscribers/watchers.

@Ryuno-Ki you should PR!

strugee on 3 Mar 2017

@strugee I have no experience with browser add-ons and would need some guidance for setting up dev environment and testing my patch.

Ryuno-Ki on 3 Mar 2017

@Ryuno-Ki https://github.com/EFForg/https-everywhere#getting-started has some instructions for getting started with HTTPS Everywhere development. I've only dabbled in HTTPS Everywhere development but I'd be happy to try and help, or I'm sure you could ping one of the core developers.

strugee on 3 Mar 2017

@Ryuno-Ki Let me know if you plan to PR, otherwise I can add a localhost exception.

Hainish on 4 Mar 2017

https://github.com/EFForg/https-everywhere/commit/1dafcc9578ab3c9287dc4f811878269fdd57f9ae resolves this. It will be deployed in 5.2.12

Hainish on 4 Mar 2017

I am not sure this is fixed or has been reintroduced as HTTPS Everywhere is now conflicting with IPFS Companion using *.localhost addresses and those get https and errors when EASE mode is enabled.