Allow unsecure connections to localhost for web extensions

[elringus]

I'm developing an extension, which is connecting to a local websocket server to provide additional metadata and utilities for the edited documents. The extension is currently running on .NET runtime and works fine via unsecured websocket connection.

I want to migrate the extension to the browser environment, so it can work on both vscode.dev and standalone VS Code instances.

I was able to make the extension work in browser. Again, it's using unsecure websocket connection to local server and works fine.

However, the same thing doesn't work in standalone mode, where unsecure connections to localhost are not allowed.

Given it's allowed in all the other cases (regular extensions, web extensions in browser), I wonder if it's possible to also allow it for web extensions running in standalone.

[elringus]

The use case for this is actually pretty wide. Imagine a scenario where you need inter-process communication between a VS Code web extension and a third-party app installed locally on the user machine (eg, LSP server or debugger). We can't expect each user to install a certificate in this case. For the same reason, unsecured connections to localhost are allowed by default in browsers.

[elringus]

Just noticed that when running vscode.dev under Chrome the unsecured connections are not allowed as well. They are somehow working in Firefox though, which made me initially think that the restriction was only for standalone mode.

I've checked the modern browsers (outside of VS Code) and they are all allowing unsecured connections to localhost by default (even when served from https domain); eg, from MDN secure context docs:

If I understand correctly, encrypting connections to localhost doesn't really benefit security: https://palant.info/2019/04/11/bogus-security-mechanisms-encrypting-localhost-traffic/

Really hope VS Code will lift the restriction, as it makes very troublesome (if at all possible) to talk with local apps from web extensions.

[elringus]

@jrieken @alexdima sorry for the ping, just wanted to make sure the topic is not lost. Can you please let know if lifting the restriction is something you may consider or is it out of the question?

[jrieken]

@alexdima Maybe it's sufficient to allow the combination of localhost and unsecure web sockets, like Content-Security-Policy: connect-src ws://localhost

[jrieken]

This should work with tomorrows insiders