demo · v138

Preflight Inspector

When a public website makes a cross-origin request to a private or loopback address Chrome sends an extra CORS preflight with the Access-Control-Request-Private-Network: true header. Enter any IP address or hostname to classify it and preview the exact preflight request/response Chrome expects.

Try:
Address classification
—
Enter an address above.

All private network ranges (RFC 1918 + loopback)

Range / addressClassificationPreflight required?
10.0.0.0/8privateYes — if request from public origin
172.16.0.0/12privateYes
192.168.0.0/16privateYes
127.0.0.0/8loopbackYes
::1loopbackYes
localhostloopbackYes
fc00::/7 (ULA)privateYes
Everything elsepublicNo (normal CORS only)
 
// A public page fetching a private IP triggers a preflight
fetch('http://192.168.1.1/api/status', {
  method: 'GET',
  // Browser automatically adds:
  //   OPTIONS preflight with:
  //   Access-Control-Request-Private-Network: true
  //
  // Server MUST respond:
  //   Access-Control-Allow-Private-Network: true
  //   Access-Control-Allow-Origin: https://public-site.com
});

// If server omits Access-Control-Allow-Private-Network: true
// → fetch() rejects with a network error (not a 4xx)

see also