Google is reportedly planning to make Chrome report all web site connecting using
http:// as unsafe.
But is this really true if the host in question is
localhost and the server is only listening for connections from the local machine? For instance, if there is a server running on the local machine and I navigate to
http://localhost:8080 is there anything insecure about that? As far as I know, this resolves to
127.0.0.1 which is inaccessible outside the local machine. I think it should never be possible for
localhost to resolve to
127.0.0.1 or that
127.0.0.1 doesn't refer to the local machine.
All communications should be going through a channel that can't be seen from another processes other than the server process on the machine and the client process which is the web browser. So sending things like passwords, session keys, etc. across the channel should be secure, right?
I'm aware of security risks which might be caused by allowing localhost access, and how these might be protected against. What other risks are there?