v145 · Web APIs · Permissions

Local Network Access split permissions

Chrome 145 introduces split permission prompts for Local Network Access (LNA), separating requests to private network ranges into distinct permission grants rather than a single all-or-nothing prompt.

background

Local Network Access (LNA) restrictions prevent public web pages from making unauthenticated requests to devices on private network ranges (192.168.x.x, 10.x.x.x, localhost). Before Chrome 145, when LNA required a user prompt, it asked a single permission covering all private network access.

Chrome 145 splits this into separate, more granular permissions — one for each target IP range class — so users can grant access to their home router without also granting access to localhost services running on their machine.

concepts

  1. LNA Permission Demo

    Shows the permission query API for local network access, checks current permission state across private network ranges, and demonstrates how to detect whether a request will require a user grant.

  2. Permission Model

    Explains the three network address spaces (private, local, public), how split permissions map to each, and the request headers Chrome adds to preflight requests.

  3. Permission Matrix

    Interactive grid: pick permission states for local-network and local-network-loopback and watch which origin×target combinations allow, prompt, or deny.

  4. Minimum Privilege Planner

    Select which local resources your app actually needs (localhost dev server, home router, IoT device) and the planner recommends which LNA permissions to request and which to skip — with generated permission query and fetch code.

the change

// Query LNA permission state (Chrome 145+)
const { state } = await navigator.permissions.query({
  name: 'local-network-access',
});
// 'granted' | 'denied' | 'prompt'

// Before Chrome 145: one permission for all private network
// Chrome 145+: split by address space
//   - loopback (127.0.0.1, ::1)
//   - private (192.168.x.x, 10.x.x.x, 172.16.x.x)
//
// Server still must respond with:
//   Access-Control-Allow-Private-Network: true
// on the actual response (after preflight success)

references