Policy
Control where security restrictions on insecure origins apply
Microsoft Edge
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows7
Specifies a list of origins (URLs) or hostname patterns (like "*.contoso.com") for which security restrictions on insecure origins don't apply. This policy allows you to specify permitted origins for legacy applications that can't deploy TLS or for internal web development staging servers. It enables developers to test features requiring secure contexts without the need to configure TLS on the staging server. Patterns are only accepted for hostnames; URLs or origins with schemes must be exact matches. This policy also prevents the origin from being labeled "Not Secure" in the omnibox. Setting a list of URLs in this policy has the same effect as setting the command-line flag '--unsafely-treat-insecure-origin-as-secure' to a comma-separated list of the same URLs. If you enable this policy, it overrides the command-line flag. For more information on secure contexts, see https://www.w3.org/TR/secure-contexts/. Example value: http://testserver.contoso.com/ *.contoso.com
Registry values
How enabled and disabled states update the registry.
No explicit registry values are set for enabled or disabled states.
Policy elements
Inputs and configuration options exposed by this policy.
| Scope | Element | Type | Registry mapping | Constraints & behavior | Copy |
|---|---|---|---|---|---|
Control where security restrictions on insecure origins apply ID OverrideSecurityRestrictionsOnInsecureOriginDesc | list | Path Software\Policies\Microsoft\Edge\OverrideSecurityRestrictionsOnInsecureOrigin Value name 1, 2, … Type REG_SZ | List: standard |