W3C home > Mailing lists > Public > public-webappsec@w3.org > September 2016

Re: `localhost` as Secure Context, take 2 (was Re: CfC: Transition "Secure Contexts" to CR; deadline August 2nd.)

From: Emily Stark (Dunn) <estark@google.com>
Date: Wed, 28 Sep 2016 10:58:11 -0700
Message-ID: <CAPP_2SbDBkZyPN3KRRdabxo90u+xi5_jRO2RV0LtvDKZsn72eg@mail.gmail.com>
To: Mike West <mkwst@google.com>
Cc: Brad Hill <hillbrad@gmail.com>, Jake Archibald <jakearchibald@google.com>, Erik Nygren <erik+w3@nygren.org>, "public-webappsec@w3.org" <public-webappsec@w3.org>, "www-tag@w3.org List" <www-tag@w3.org>, Dan Veditz <dveditz@mozilla.com>, Wendy Seltzer <wseltzer@w3.org>
We twittered about this briefly, but I wanted to check: is the proposal
that 'let localhost be localhost' goes through and then Secure Contexts
changes to say that browsers should hardcode the resolution of local
hostnames to loopback IPs?

On Wed, Sep 28, 2016 at 5:24 AM, Mike West <mkwst@google.com> wrote:

> On Tue, Aug 2, 2016 at 8:51 PM, Mike West <mkwst@google.com> wrote:
>> * In https://github.com/w3c/webappsec-secure-contexts/issues/43, Erik
>> suggested that the move to exclude `localhost` was the wrong way to solve
>> the problem, and that we should instead treat it as "secure" if it resolves
>> to a loopback address. Recorded in the spec as
>> https://w3c.github.io/webappsec-secure-contexts/#issue-8ea95bab. Without
>> some change in the way that agent's DNS resolvers handle these names, I'm
>> reluctant to change the spec, but perhaps pushing for that change is a
>> reasonable thing to do.
> Following up on this now that we've hit CR: I've written up the change to
> DNS resolvers suggested in the GitHub discussion at
> https://tools.ietf.org/html/draft-west-let-localhost-be-localhost.
> The general response has been positive, but opinions from folks on this
> list would be appreciated. If we can get something like this proposal
> adopted in user agents, I'd be comfortable calling `localhost` as secure as
> ``. WDYT?
> -mike
Received on Wednesday, 28 September 2016 17:59:00 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:54:57 UTC