>Wrong, because your web application should be using https. For security reasons, the browser will _not_ allow connections from an https-page to a non-https (or secured web sockets) server. Thus, your native app's exposed API must use https/wss too. And here is where the article's ordeal begins.

The article also says that the website could make requests to http://127.0.0.1:portnumber/ and browsers will allow that even from HTTPS websites.