Insecure password warning appears on localhost IP when opened by host name
Categories
(Firefox :: Security, enhancement)
Tracking
()
People
(Reporter: rimas, Unassigned)
References
Details
I'm working as a web developer and routinely run the websites I work on in containers with localhost ports forwarded. Some of them are configured to use specific hostnames, in which case I don't use http://localhost/ as their address, but rather use http://some-alias.some-suffix/.
I noticed that in such case Firefox presents me with the unsafe password warning, which I sometimes click accidentally, because very often it overlays the password field.
Could anything please be done about this? I don't mind whitelisting hostnames manually via about:config or whatever, but I'm really irritated by that dialog which in my case is nothing but an annoyance.
|
||
Comment 1•1 year ago
|
||
The severity field is not set for this bug.
:manuel, could you have a look please?
For more information, please visit BugBot documentation.
|
||
Comment 2•1 year ago
|
||
Fundamentally this boils down on what is considered secure context.
Password fields could be handled separately. However, this would increase complexity for slim benefit. We might accept patches for that, but very likely not implement on our own.
@Freddy is "treat localhost, but with a different host name as secure context" something we would be interested in implementing or do we have a pref for it already? If not are there past discussions about implementing for nsMixedContentBlocker::IsPotentiallyTrustworthyLoopbackURL?
|
||
Comment 3•1 year ago
|
||
Given how the web works, it would make much more sense for folks to use http://some-alias.localhost.
We already codify that localhost (including *.localhost) is a secure context.
You could either set up a *.localhost name for your development containers or set up a reverse proxy on your local machine that then proxies the connections to the container address.
Description
•