Thank you for reporting the issue.

Adding palmer@ who may know more about the recent HSTS changes and whether HSTS should be applied to localhost.

Meanwhile you can try the following workaround:
1) You can add a new host name to C:\Windows\System32\Drivers\etc\hosts file that maps to 127.0.0.1 and use it to connect to your developer server e.g.:
127.0.0.1 dev-webserver.local
You may need to change your dev server configuration accordingly.

Here are some other ideas from stackoverflow that may work better for you.
https://stackoverflow.com/questions/25277457/google-chrome-redirecting-localhost-to-https

I do not think there is a reason not to apply HTTP Strict-Transport-Security to localhost. If you are sending the header, you are asking for it. Do not send the header in your development machine (or filter it).
However, if it seems to be applied without (ever!) sending that header, then this is a bug.
So, which is it?

Thank you both for responding.  I dont know about the HSTS header or how
its getting added.  My front end web app is running on http://localhost:8081.
Some calls redirect to https://localhost:8443/ for 2 way ssl pki login with
CAS which involve several back and forth redirects.  Lastly I call a
spring-boot web service running on https://localhost:8999 which also
redirects to https://localhost:8443/cas, with redirects, and CORS mixed
in.  Maybe CAS or the spring boot service is injecting HSTS headers.  I
dont know how they get added but everytime I start the system, now after
Chrome updated, I have to remove localhost from HSTS page in Chrome and
then it works until I reload.  I have to re-deleted the localhost from HSTS
many times a day now.

What would add the header?

I guess if CAS or spring-boot are adding the header, then maybe I could add
3 different aliases to host file for 127.0.0.1, local-dev, local-cas,
local-springboot.

Thanks again for taking time to help me

One of them is probably heading the header. I think this is by design for Chrome. Use different hosts instead, like you mentioned.

s/heading/adding/

If you look in the DevTools network panel, you can probably find out which one is adding the header and then remove that. If you do that, do you see the Strict-Transport-Security header?

I agree that there's no need for a special-case here. If https://localhost is setting the HSTS header, then it is asking for just such a redirect.