From 2.6.7, localhost is blocked by default. If you don't want it, use --forbidden-ip="".

From 2.6.3, you can prevent the server from connecting to some IP like 127.0.0.1.

ssserver -c /etc/shadowsocks.json --forbidden-ip 127.0.0.1,::1

Notice only IPv4 and IPv6 addresses are allowed. Blocking will be processed after DNS.

This is because if a client tries to visit a hostname, like localhost or a domain name a user has pointed to 127.0.0.1, it will be resolved into 127.0.0.1 or ::1. Thus it will still get blocked.