Allow passkeys for insecure domain (`localhost`)

[Spomky]

We are happy to answer your questions about the code or discuss technical ideas.

Please complete the following checklist (by adding [x]):

• [x] I have searched open and closed issues for duplicates
• [x] This isn't a feature request
• [x] This is not a report about my app not working as expected

---

Hi,

I would like to test an application with authenticators that are backed up like the ones managed by ProtonPass. During the registration process, I am facing the following message:

failed to generate passkey: InsecureLocalhostNotAllowed

Please note that the browser (Chrome 126) considers the domain is secure (HTTPS with a trusted root CA).

❓ Question: How to allow the creation of passkeys on localhost? Is there any option to turn on/off?

[Salamafet]

Same here on Firefox 131.0.3 (aarch64)

[james-pre]

Can a maintainer please take a look at this issue? @D-Bao?

[cfischbeck]

I am also running into this issue.

[yamafaktory]

As per the official W3C spec, the RP ID (Relying Party Identifier) can definitely be localhost -> https://www.w3.org/TR/webauthn-3/#relying-party-identifier. That's clearly a blocker for local development :).

[arshx86]

thanks proton to blocking local development

[bgub]

Bumping