v147 · Security · WebTransport Demo

WebTransport Demo

Which WebTransport connections are gated by LNA in Chrome 147, and the server-side response required to allow a public-to-private session.

WebTransport uses QUIC/HTTP3. Unlike WebSocket's HTTP-level upgrade, WebTransport's LNA preflight is handled at the QUIC connection level. The server must return Access-Control-Allow-Private-Network: true in its HTTP/3 response headers.

connection matrix

Source	Target	Chrome 147
https://public.example.com	https://192.168.1.100:4433	LNA preflight required
https://public.example.com	https://10.0.0.1:4433	LNA preflight required
https://public.example.com	https://localhost:4433	LNA preflight required
https://public.example.com	https://api.public.example.com:4433	Allowed — both public
http://192.168.1.50	https://192.168.1.100:4433	Allowed — private to private

WebTransport vs WebSocket LNA

WebSocket LNA (Chrome 147)

HTTP GET preflight before WebSocket upgrade
Standard HTTP request/response
Runs over TCP
Headers: Access-Control-Request-Private-Network

WebTransport LNA (Chrome 147)

LNA check during QUIC connection setup
HTTP/3 response headers carry the opt-in
Runs over QUIC/UDP
Headers: Access-Control-Allow-Private-Network

server fix

// Node.js WebTransport server — add LNA response header
import { Http3Server } from '@fails-components/webtransport';

const server = new Http3Server({
  port: 4433,
  host: '0.0.0.0',
  secret: 'secret',
  cert: certPem,
  privKey: keyPem,
});

server.on('sessionready', session => {
  // Add LNA header to allow public pages to connect
  session.writeHead(200, {
    'Access-Control-Allow-Private-Network': 'true',
    'Access-Control-Allow-Origin': 'https://public.example.com',
  });

  session.on('datagramreceived', data => {
    // Handle incoming datagrams
  });
});

scenario focus

Select a scenario to focus its rendered example and summary.

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗