flag: allow-insecure-localhost going away?

[Anuj Goyal]

Security Team,

I think a lot of customers are still using this flag.

See this post on the Enterprise forum

https://support.google.com/chrome/a/thread/3095439?hl=en

Who is the PM/TL that built this?  it might be useful to have the context before we remove it so that we can write it up in our release notes.

Flag Name	Expired In	Listed Owners	Actual Contacts ( Email)
allow-insecure-localhost	76	security-dev	securi...@chromium.org

-Anuj

PM: Chrome Browser Enterprise

[Brandon Heenan]

I made some comments in the flag expiry design doc suggesting that a good mitigation for this case would be to add a policy to replace the functionality of the flag. We should do that if we believe there's a real need for enterprises to switch on this behavior

[Christopher Thompson]

Hi all -- 

I've uploaded a CL to bump the expiration on the allow-insecure-localhost and unsafely-treat-insecure-origin-as-secure, so these will still be available from chrome://flags in M-78+. We may revisit these flags in the future, but we don't currently have plans to remove them.

If there are specific enterprise use cases for the allow-insecure-localhost flag, that might be good to know as well for making longer term plans (the linked Enterprise forum thread doesn't have any useful information in it).

- Chris

[Brandon Heenan]

I think it's a development use case, to allow people to run/test https sites they're building locally. Is there a better / another way of accomplishing that use case?