How to avoid proxy bypass by browsers for localhost?

Gleb Lepeshkin
Head of Content Marketing

Browsers and operating systems bypass the proxy for localhost and 127.0.0.1 by default, so local traffic never reaches your proxy. To force it through, remove localhost from the no-proxy list, use a browser flag like –proxy-bypass-list=”<-loopback>”, or route it with an extension such as FoxyProxy.

Why Browsers Bypass the Proxy for Localhost and How to Force It Through

Every major browser and OS ships with a built-in bypass list that excludes loopback addresses — localhost, 127.0.0.1, and ::1 — from proxying. The assumption is that local services should never leave the machine. That is correct for most users, but it breaks debugging setups where you intentionally want loopback traffic captured by a local proxy such as Charles, mitmproxy, or Burp Suite.

The fix depends on the browser.

Chrome and Edge respect a launch flag. Start the browser from the command line with both flags set:

Windows:
chrome.exe –proxy-server=”host:port” –proxy-bypass-list=”<-loopback>”

macOS:
/Applications/Google Chrome.app/Contents/MacOS/Google Chrome –proxy-server=”host:port” –proxy-bypass-list=”<-loopback>”

The <-loopback> token explicitly cancels the default loopback exception. Without it, –proxy-server alone still skips localhost. Both flags must be present.

Firefox exposes the same control without restarting from the command line.
Open about:config, search for network.proxy.allow_hijacking_localhost, and set it to true. Firefox will then route requests to localhost through whatever proxy is configured in its network settings.

Alternatively, use FoxyProxy in Firefox or Chrome. Add a rule matching the pattern localhost or 127.0.0.1 and point it to your local proxy. This gives you per-URL control without touching browser flags or config keys.

Note the security reason this is locked down: forcing loopback through a proxy means a misconfigured or hostile proxy can intercept traffic you assumed never left your machine. Re-enable the default bypass once you are done debugging, and never leave allow_hijacking_localhost set to true in a production profile.