Like NPM's https-localhost, serve IPFS' localhost in HTTPS

[danimesq]

This will enable dapps like FrameworkJS Web3 template to work locally.

[danimesq]

Important: it could break dependents such as @jfmherokiller's webtorrent2ipfs as it requires an gateway that doesn't forces HTTPS.

[lidel]

Hey, triaging older issues, thanks for the original report!

A bit of history may help here. Back when this was filed in 2021, the real reason people wanted HTTPS on localhost was that browsers treated plain http://localhost as "not secure", so some web features (Service Workers, Web Crypto, Clipboard, and friends) refused to run. The usual workaround was tools like https-localhost that install a local certificate.

The good news is that this has been resolved at the browser level. Modern Firefox and Chromium-based browsers now treat http://localhost and http://*.localhost as a secure context out of the box, so those web features just work on the Kubo gateway without any HTTPS setup. This came out of a long, patient collaboration with Igalia and the browser teams. The full timeline lives in the ipfs/in-web-browsers README.

Upstream tickets, for reference:

Firefox (shipped in Firefox 84, December 2020):

• Bugzilla 1220810: hardcode localhost names to the loopback address, making them a secure context
• Bugzilla 1488740: stop treating http://localhost/ as mixed content

Chromium:

• crbug 589141: *.localhost should be considered secure
• chromestatus 6269417340010496: treat http://localhost as a secure context

What this means for Kubo today:

• the default gateway at http://127.0.0.1:8080 already runs under a secure context, so Web Crypto, Service Workers, etc. work
• the subdomain form at http://*.ipfs.localhost works the same way and gives each site its own origin

For the smaller set of cases where you really do need a browser-trusted certificate (for example, a page served from a public origin talking to your local node), the new HTTPProvider feature in #11333 reuses the AutoTLS-issued Let's Encrypt certificate and exposes the trustless gateway over real HTTPS.

Closing as resolved by upstream browser changes. If a specific app or API is still broken in a current browser, please open a fresh issue with a minimal reproducer and we will take a look. Thanks again for filing!