v147 · Security · Preflight Flow

Preflight Flow

How the LNA preflight works for WebTransport connections — the QUIC-level handshake, required server response headers, and the browser's decision tree.

WebTransport's LNA preflight differs from WebSocket's HTTP GET preflight. Because WebTransport runs over QUIC (HTTP/3), the opt-in header is returned in the initial HTTP/3 response rather than a separate preflight request. Chrome evaluates the header before exposing the transport to JavaScript.

connection sequence

  1. 1 Page calls new WebTransport('https://192.168.1.100:4433/')
  2. 2 Chrome checks: source is public, target is private → LNA check required
  3. 3 Chrome initiates QUIC handshake with the local server
  4. 4 Server completes QUIC handshake and returns HTTP/3 response headers
  5. 5 Chrome reads Access-Control-Allow-Private-Network from the response headers
  6. 6 Header present → transport.ready resolves; absent → rejects with network error

required server response

HTTP/3 response from local server (QUIC stream 0)
HTTP/3 200 OK
Access-Control-Allow-Origin: https://public.example.com
Access-Control-Allow-Private-Network: true

No separate preflight request is sent — the opt-in header must be in the initial HTTP/3 200 response. The QUIC connection itself is established before Chrome evaluates the header; if the header is absent, Chrome closes the QUIC connection immediately without exposing it to JavaScript.

error handling

const transport = new WebTransport('https://192.168.1.100:4433/');

try {
  // Awaiting .ready is required before using the transport
  await transport.ready;
  console.log('Connected');
} catch (err) {
  // LNA rejection surfaces here
  // err.message: 'Failed to connect to server'
  console.error('LNA blocked or connection failed:', err);
}

// .closed also rejects if LNA blocks during session
transport.closed.catch(err => {
  console.log('Transport closed:', err.message);
});

see also

scenario focus

Select a scenario to focus its rendered example and summary.

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗