demo · v145

targetAddressSpace fetch option

The Chrome 145 spec dropped CORS preflights in favour of an in-browser permission prompt — but developers must opt in via a new fetch() option: targetAddressSpace. Pick a target, pick a value, fire the request, and see what the browser actually does.

Behind chrome://flags/#enable-local-network-access-checks in pre-stable. In Chrome 145+ stable it ships on by default, but the permission prompt only appears for cross-address-space requests from secure contexts (this page over HTTPS).

Tip: try a loopback URL with targetAddressSpace: "loopback" vs "local" to see which permission the browser asks for.

what the option does

The browser classifies every fetch by IP-address-space (public / local / loopback). When a page in a higher space requests a target in a lower space, the request is gated. Without targetAddressSpace set, Chrome will still attempt the request but will not show a permission prompt — many connections will be silently blocked. Setting the option declares your intent and lets the browser ask the user.

// declare you intend to hit the local network
const res = await fetch("http://192.168.1.1/api", {
  targetAddressSpace: "local"
});

// for loopback (developer tools, local servers)
const res = await fetch("http://127.0.0.1:5173/", {
  targetAddressSpace: "loopback"
});

see also