title: How to use a secure WebSocket-Connection for a local client
body: <p>I need informations about security risks and proof of concepts to work with an local client.</p>
  <p>In my option, a user will install two components:</p>
  <ol>
  <li>The game client</li>
  <li>The client launcher</li>
  </ol>
  <p>The launcher is running as an background process all the time. The launcher provides an <code>WebSocket</code> server.
  The user will open my website to start the game (with game-server lists and other settings). The Website connects to the game launcher to handle all actions (change configuration, start the game executable)..</p>
  <p><strong>Problem:</strong></p>
  <p>How realize the communication with the website and the game launcher? Okay, Websockets, yes. But browsers forbid to connect to localhost/127.0.0.1 by security reason.</p>
  <p>An fake-pointer as DNS or hosts-file to an subdomain like <code>local.game.tld</code> is bad, because SSL-Certificates can be revoked here as bad usage.</p>
  <p>Another idea was to provide an NPAPI-Plugin for the browser. But it seems, that the NPAPI is deprecated and useless for the future.</p>
  <p>Whats the best practice to communicate between <code>webpages</code> and local installed <code>software</code>?</p>