So after talking about it with @EverlastingBugstopper we thought about how to structure https with dev. With dev there's the local server which accepts your requests and there's what you upstream to. We were thinking that making https default for both local and upstream would add a lot of friction to users when they run into browser warnings and curl failing without --insecure. Plus it seems most use cases won't use this. Instead making http default for both would have less friction and for other use cases we can add "local-https" and "upstream-https" cli argument (and wrangler.toml argument). Https will opt where those users can deal with the friction. This covers use cases where users rely on https behavior or if someone has a host that uses https but wants their local to be http. We just need to make sure we have good docs about the new arguments because it's not really apparent what they mean at first glance.

Instead making http default for both

To clarify... Are you saying that wrangler dev would by default connect to Cloudflare's edge via HTTP, not HTTPS?

I think that would be a dangerous default. We should be encrypting all network traffic unless the user very explicitly tells us not to.

Moreover, most sites these days enable "always use HTTPS" which causes all HTTP requests to return a redirect to HTTPS, which would likely lead to confusion when using wrangler dev.

I do agree that traffic to localhost should not use HTTPS since there's no such thing as a valid certificate for localhost, and there's also no possibility of MITM.

To clarify... Are you saying that wrangler dev would by default connect to Cloudflare's edge via HTTP, not HTTPS?

I think that would be a dangerous default. We should be encrypting all network traffic unless the user very explicitly tells us not to.

That's what I was intending but this makes sense. Local http and upstream https by default sound good? @EverlastingBugstopper @ashleymichal

the following configurations should be possible. when i say upstream i mean cloudflare's edge OR the --host specified for gcs dev, and when i say local i mean the protocol on the developers machine

upstream https + local http (default)
upstream https + local https
upstream http + local http

upstream http + local https should not be possible i think