docs: qualify Freighter HTTPS requirement for localhost - #2851
Conversation
http://localhost and http://127.0.0.1 are secure contexts per the W3C Secure Contexts specification, so the blanket HTTPS requirement gave the wrong impression for local development. Keep the HTTPS setup steps as optional. Fixes #2773
There was a problem hiding this comment.
Pull request overview
Clarifies Freighter’s HTTPS guidance for localhost development.
Changes:
- Documents loopback HTTP as a secure context.
- Keeps HTTPS setup instructions optional.
Suppressed comments (1)
docs/build/guides/dapps/frontend-guide.mdx:78
- This paragraph now makes a normative browser/security-context claim, but it only names the W3C specification and does not link to it. Please add the cited specification URL so readers can verify the localhost/loopback exception (the linked issue explicitly calls for this citation).
Freighter wallet requires a secure connection to interact with your dapp. Browsers treat `http://localhost` and `http://127.0.0.1` as secure contexts per the W3C Secure Contexts specification, so local development over plain HTTP works without extra setup. To enable HTTPS on localhost anyway, you can use a tool like `mkcert`. Fortunately, Next.js provides built-in support for HTTPS.
Note
Copilot is running an experiment and ran this review at Lite.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| ### Setup HTTPS on Localhost | ||
|
|
||
| Freighter wallet requires a secure connection (HTTPS) to interact with your dapp. To enable HTTPS on localhost, you can use a tool like `mkcert`. Fortunately, Next.js provides built-in support for HTTPS. | ||
| Freighter wallet requires a secure connection to interact with your dapp. Browsers treat `http://localhost` and `http://127.0.0.1` as secure contexts per the W3C Secure Contexts specification, so local development over plain HTTP works without extra setup. To enable HTTPS on localhost anyway, you can use a tool like `mkcert`. Fortunately, Next.js provides built-in support for HTTPS. |
ElliotFriend
left a comment
There was a problem hiding this comment.
thanks for the contribution!
|
PR Preview: torn down |
|
Thanks for merging, @ElliotFriend! Qualifying that one sentence saves readers from provisioning TLS they never needed. |
|
Raven independently verified this fix on September 16, 2026. The rendered frontend guide and its indexed HTTPS section qualify HTTP localhost and 127.0.0.1 as secure contexts. The complete index read returned 35 sections. The old unqualified HTTPS requirement is absent. HTTPS is now an optional local setup. A separate reviewer repeated the source and index checks. |
What and why
The dapp frontend guide stated one unqualified requirement: "Freighter wallet requires a secure connection (HTTPS) to interact with your dapp", then pointed readers at HTTPS setup for localhost.
http://localhostandhttp://127.0.0.1are alreadyPotentially Trustworthyorigins under the W3C Secure Contexts specification, so plain HTTP on loopback satisfies Freighter's secure-context requirement and the sentence overstates what is needed.The paragraph now names the loopback exception and keeps the HTTPS setup steps as optional. Nothing else in the guide changes.
Fixes #2773
Testing
Docs-only change; verified the surrounding section still reads correctly and the mkcert /
next dev --experimental-httpssteps remain intact.