By default, access to [::1] and localhost are disallowed in Microsoft Edge. One way to workaround this is to enable it in the about:flags page:

Microsoft Edge about:flags

On that label it also says (this might put your device at risk).

What risks am I exposing myself to by allowing localhost loopback?

I'm thinking that XSS wouldn't be a risk due to Same Origin Policy (unless I'm XSS-ing a site running on my own local web server, but in that case the attacker already has local control of my device).

1 Answer 1


One risk that can occur here is Cross-Site Request Forgery (CSRF). Say you have an application running on your localhost which presents a web server for administration purposes. If you allow localhost in a browser, when visiting a site controlled by the attacker, the attacker could request a URL such as

which if valid for the site listening on that host could cause an inadvertent action to be taken.

Now this of course requires a vulnerable service to be listening on that port, so not everyone would be at risk here. However what Microsoft have likely done is look at the trade-offs of allowing or disallowing this access and decided that for the majority use case there's more risk than benefit, so they've set this default, whilst providing a work-around if needed.

  • 2
    How is requesting http://localhost/admin/do_some_action?delete=yes any different from requesting something like http://mybank.com/admin/do_some_action?delete=yes?
    – Michael
    Commented Jan 3, 2017 at 23:13
  • 1
    well generally localhost is only available locally, so developers may well make an assumption that requests come from the local user and can therefore be trusted, whereas you'd hope that mybank.com would know about CSRF and defend against it. Commented Jan 4, 2017 at 21:44
  • "generally localhost is only available locally" Generally, or always?
    – curiousguy
    Commented Jun 22, 2018 at 18:49
  • With the vast number of possible combinations of networking and operating system setup, it would be difficult to be absolute :) Commented Jun 24, 2018 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .