What host makes that happen @buck54321 ? A non-loopback addr?

http://[::]:54321

The test app server

So is that a chrome bug with ipv6? That looks like it should qualify as a secure context/origin.

Looks like this does the trick.

https://github.com/martonp/dcrdex/compare/copyAddress...buck54321:martonp-copy-addr?expand=1

Ah, yes! I read it as [::1] which basically the opposite of [::].

Actually, this would prevent me from copying if I access the client from, say, my tablet on the same network.

Maybe navigator.clipboard won't work for us?

I think it's OK. The user can get around that other ways, including putting an https server in front of it or changing the browser flags et.
If navigator.clipboard isn't available, they can still manually select and copy like it was before.

Is it unsafe to use execCommand with a hard-coded argument? If it's safe, might as well do it that way, no?

execCommand and friends are deprecated: https://developer.mozilla.org/en-US/docs/Web/API/document/execCommand

Deprecated: This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.

I'm switching dcrdata over and it's working alright there: https://github.com/decred/dcrdata/pull/1917/files

I pulled your commit in @buck54321