[cloudwizard]

It works in secure contexts. internal domains with .localhost name are considered secure.

https://developer.mozilla.org/en-US/docs/Web/Security/Secure... Locally-delivered resources such as those with http://127.0.0.1 URLs, http://localhost and http://*.localhost URLs (e.g. http://dev.whatever.localhost/), and file:// URLs are also considered to have been delivered securely.

[xg15]

Yes, because they are hardwired to point to your own machine. You cannot use those to deploy an internal webapp.