v147 · Security · Preflight Flow

Preflight Flow

Step-by-step: how Chrome sends an LNA preflight before upgrading to a WebSocket connection, what headers the local server must return, and what Chrome does with the response.

LNA WebSocket preflight sequence

  1. 1 Public page calls new WebSocket('ws://192.168.1.100:8080/ws')
  2. 2 Chrome detects: source is public, target is private network address → LNA check required
  3. 3 Chrome sends an HTTP GET preflight to the same URL before the WebSocket upgrade
  4. 4 Local server responds with LNA headers (or doesn't)
  5. 5 If approved: Chrome sends the WebSocket upgrade request (Upgrade: websocket)
  6. 6 If denied or timeout: WebSocket fails with a network error; ws.onerror fires

preflight builder

Change the target, source origin, and local-server response to see exactly when Chrome sends the WebSocket upgrade.

preflight request

HTTP preflight (Chrome → local server)
GET /ws HTTP/1.1
Host: 192.168.1.100:8080
Origin: https://public.example.com
Access-Control-Request-Private-Network: true

required server response

HTTP response (local server → Chrome)
HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://public.example.com
Access-Control-Allow-Private-Network: true

outcomes

Preflight approved

  • Server returns 200 + Access-Control-Allow-Private-Network: true
  • Chrome sends WebSocket upgrade request
  • Normal WebSocket connection established
  • ws.onopen fires

Preflight rejected

  • Server returns non-200, missing header, or times out
  • Chrome does not send the WebSocket upgrade
  • ws.onerror fires
  • Console shows: ERR_FAILED / blocked by LNA

see also

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗