HSTS middleware should explicitly avoid sending the header for localhost

[javiercn]

This will cause a headache in the

dotnet new
dotnet publish
dotnet <app>.dll scenario

Turn it off for localhost by default and provide an option to turn it on if we think it's necessary.

[jkotalik]

What would we consider localhost? I'd assume we need to include localhost, 127.0.0.1, and ::1.

[Tratcher]

This way lies madness....

[javiercn]

@Tratcher We can just have a list of exclusions that we populate by default, with something along the lines of what @jkotalik mentioned (we would have to think through this). That way, if you really want it, you have a way out (and you can exclude additional hosts, for example when you develop against your machine name or any other thing you put in your host file, (for example if you use a .dev domain for development)

[jkotalik]

Excluding additional hosts would be interesting to expose. What would the usability scenario be? Do we want to allow regex matching (for example, to support your .dev scenario)? It seems like we would need to expose two options: a list of excluded domains and a bool for whether to exclude localhost or not.

[javiercn]

@jkotalik Just a list will do, no regex no anything fancier. The scenario is when you setup your box to develop with something different than localhost, which is pretty common. (And obviously to exclude localhost by default)

[blowdart]

I can see the need for this, even if I hate it.

[jkotalik]

@muratg thoughts?

[muratg]

cc @shirhatti @danroth27