Yes. localhost is considered a Secure Context via https://w3c.github.io/webappsec-secure-contexts/#potentially... - This is intentional to testing APIs which require a Secure Context easier to use during development. E.g., ServiceWorkers.