<- Chrome Settings Library

UnsafelyTreatInsecureOriginAsSecure

Origins or hostname patterns for which restrictions on insecure origins should not apply
Last updated October 8, 2024
Deprecated

Deprecated in M69. Use OverrideSecurityRestrictionsOnInsecureOrigin instead. The policy specifies a list of origins (URLs) or hostname patterns (such as "*.example.com") for which security restrictions on insecure origins will not apply. The intent is to allow organizations to allow origins for legacy applications that cannot deploy TLS, or to set up a staging server for internal web development so that their developers can test out features requiring secure contexts without having to deploy TLS on the staging server. This policy will also prevent the origin from being labeled "Not Secure" in the omnibox. Setting a list of URLs in this policy has the same effect as setting the command-line flag '--unsafely-treat-insecure-origin-as-secure' to a comma-separated list of the same URLs. If the policy is set, it will override the command-line flag. This policy is deprecated in M69 in favor of OverrideSecurityRestrictionsOnInsecureOrigin. If both policies are present, OverrideSecurityRestrictionsOnInsecureOrigin will override this policy. For more information on secure contexts, see https://www.w3.org/TR/secure-contexts/

Supported On:
Platform Start End
Chrome (Windows, Mac, Linux) 65
Example value:

{"0":"http://testserver.example.com/","1":"*.example.org"}

Features: