demo · v142

Preflight Header Inspector

LNA adds a private-network preflight: before a public site can fetch a local IP, Chrome sends a CORS preflight with Access-Control-Request-Private-Network: true. The target must return Access-Control-Allow-Private-Network: true AND request the permission. Step the negotiation and watch which header is missing.

browser → target

target → browser

— —

relevant markup

// 1. The browser detects the request crosses from a less-private to a
//    more-private address space → it must send a preflight.
OPTIONS /probe HTTP/1.1
Access-Control-Request-Method: GET
Access-Control-Request-Private-Network: true
Origin: https://news.example

// 2. The target server must explicitly opt in.
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://news.example
Access-Control-Allow-Private-Network: true

// 3. The browser also asks the user, unless permission is already granted.

see also