Local Network Access restrictions for WebTransport

concepts

1. WebTransport Demo

   Shows which WebTransport connections Chrome 147 gates behind LNA preflight, and which connections are unrestricted. Includes the server response headers required to grant access from a public page.

2. Preflight Flow

   Details the LNA preflight mechanism for WebTransport (QUIC-based, different from HTTP WebSocket upgrade) and how the server signals consent before the QUIC connection is accepted.

3. WebTransport LNA Threat Model

   Compares the attack surface before and after Chrome 147 with interactive side-by-side attack scenarios, the required preflight header exchange, and a live browser-capability probe for WebTransport and LNA status.

4. WebTransport LNA Tester

   Classifies WebTransport URLs by IP space (loopback / private / public), traces the full LNA handshake flow step-by-step, and attempts a real new WebTransport(url) connection — showing whether the server's LNA opt-in headers are present.

5. Compatibility Lab

   Detects WebTransport availability and classifies page origin context. Shows which WebTransport connection targets require LNA opt-in headers. Provides the server-side HTTP/3 SETTINGS parameter pattern for granting private network access to WebTransport sessions.

why it shipped

WebTransport uses QUIC to provide multiplexed, low-latency communication. Like WebSockets before Chrome 147's restriction, WebTransport connections from public websites to local network servers were unrestricted — any public page could establish a WebTransport session to a device on the user's local network. Chrome 147 closes this by requiring local servers to explicitly opt into cross-network connections, preventing public websites from probing, attacking, or extracting data from local network devices via WebTransport.

the change

// Public page attempting WebTransport to local server:
const transport = new WebTransport('https://192.168.1.100:4433/');

// Chrome 147: before the QUIC connection is accepted,
// the server must respond to an LNA preflight with:
//   Access-Control-Allow-Private-Network: true

try {
  await transport.ready;
  // Connection established — server opted in
} catch (err) {
  // Connection refused — server missing LNA headers
  // err.message: 'Failed to connect to server'
}

// Server-side (node-webtransport or similar):
// Set Access-Control-Allow-Private-Network: true
// in the HTTP/3 connection response headers

references

• ChromeStatus entry
• MDN — WebTransport API
• Chrome Developers — Local Network Access