v145 · Web APIs · Permission Model

Permission Model

The three network address spaces, how Chrome 145 split permissions map to each, the preflight request flow, and the required server headers.

address spaces

Space Examples Chrome 145 permission Notes
loopback 127.0.0.1, ::1, localhost Separate grant Local dev servers, localhost APIs
private 192.168.x.x, 10.x.x.x, 172.16–31.x.x Separate grant Routers, smart home devices, LAN servers
public All other IPs No restriction Normal internet requests

preflight request flow

1.Browser detects the fetch target is in a private or loopback address space.
2.Browser sends an OPTIONS preflight with Access-Control-Request-Private-Network: true.
3.If the permission state is prompt, the browser shows a permission dialog before sending the preflight.
4.Server must respond to the OPTIONS preflight with Access-Control-Allow-Private-Network: true (plus standard CORS headers).
5.On success, the browser sends the actual request. On failure or user denial, the fetch rejects with a network error.

required server headers

# Preflight OPTIONS response (from private network device)
HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://your-site.example
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Private-Network: true   # Required for LNA

# Actual response
HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://your-site.example
Content-Type: application/json

before vs after Chrome 145

Scenario Before Chrome 145 Chrome 145+
User grants LNA permission All private network access granted (loopback + private) Only the specific address space is granted
Site accesses router (192.168.1.1) then localhost One prompt covers both Two separate prompts
User revokes permission All LNA access revoked together Revoke only affects the specific space

see also

scenario focus

Select a scenario to focus its rendered example and summary.