demo · v138

Permission flow simulator

Pick a sender origin (public, private, local) and a target. The simulator runs the v138 LNA decision tree, shows the CORS preflight that gets sent, and reports the verdict: allowed, requires permission prompt, or blocked. The full address-space matrix is laid out below.

Phased rollout in Chrome 138. Local Network Access (LNA) extends Private Network Access. Public origins requesting local resources must (1) send a CORS preflight with Access-Control-Request-Local-Network: true, (2) get a CORS response that opts in, and (3) trigger a user-permission prompt on first use.

public

  • https://example.com
  • https://news.site.test
  • https://malicious.example

global IPv4 / IPv6 — most websites

private

  • http://10.0.0.5
  • http://192.168.1.100
  • http://intranet.local

RFC 1918 ranges

local

  • http://localhost
  • http://127.0.0.1:3000
  • http://192.168.1.1 (router)

loopback + router

Preflight (computed)

choose source + destination above.

Verdict

—

Address-space matrix · Chrome 138

from \ to
local
private
public
local
OK
OK
OK
private
preflight + permission
OK
OK
public
preflight + permission
preflight + permission
OK

What's happening

  1. Three address spaces — public, private, local — based on RFC 1918 + loopback.
  2. A request from a less-trusted space to a more-trusted space triggers LNA: a CORS preflight with Access-Control-Request-Local-Network: true.
  3. The server must respond with Access-Control-Allow-Local-Network: true. The browser then prompts the user for permission.
  4. The user's grant is per-origin-pair and persists until revoked.
  5. Blocks the canonical CSRF-against-router class of attack: a public page can no longer silently POST to http://192.168.1.1/admin/.

see also