[aaronmdjones]

    Wait, Chrome is now requiring HSTS for localhost?

If you point it at https://localhost/ and the cert is valid (e.g. you installed a private CA and used it to sign a cert for localhost) and the site serves an HSTS header, yes. Like any other hostname.

People who set up an HTTPS dev environment and have it send an HSTS header and then get annoyed when it behaves exactly as designed (and they know it) are rather out of touch, in my opinion. If you don't want the browser to force HTTPS, don't tell it to.

[Already__Taken]

localhost isn't solely the property of whatever is serving that site at that time though. You're at the mercy of one app doing it then breaking everything else for you.