Is it possible to allow 127.0.0.1 when accessed under secure domain?

[cyjake]

Chrome allows loading resources from http://127.0.0.1 AFAICT and it helps local developments a lot. webpack-dev-server usually serves resources at http://127.0.0.1 also (and sometimes on a different port against the main express/egg service for better build performance).

[nougad]

Any update here? By now http://127.0.0.1 works in Firefox as well.

It looks like this line requires an update:

sockjs-client/lib/main.js

Lines 77 to 81 in 89f0128

	var secure = parsedUrl.protocol === 'https:';
	// Step 2 - don't allow secure origin with an insecure protocol
	if (loc.protocol === 'https:' && !secure) {
	throw new Error('SecurityError: An insecure SockJS connection may not be initiated from a page loaded over HTTPS');
	}

Instead of !secure it should be something like:

if (loc.protocol === 'https:' && parsedUrl.hostname !== '127.0.0.1' && !secure) {