v147 · Service Workers · Security · LNA

SW Navigate LNA Scope Map

Chrome 147 restricts windowClient.navigate() in Service Workers: navigating a client to a URL in a more-private network tier now requires an LNA header. Enter any URL pair to see the allowed/blocked matrix, or explore the full permission table.

URL pair checker

Full permission matrix

Each cell shows whether a SW registered at origin (row) can navigate clients to a URL in tier (column). Allowed* requires the target to respond with Access-Control-Allow-Private-Network: true.

The network tiers are: public (internet routable IPs), private (RFC 1918: 10.x, 172.16–31.x, 192.168.x), local (loopback: 127.x, localhost). Higher tiers can navigate to the same or less-private tier freely; navigating to a more-private tier requires an LNA header.

service worker code

// service-worker.js
self.addEventListener('message', async event => {
  if (event.data.type !== 'navigate') return;

  const clients = await self.clients.matchAll();
  for (const client of clients) {
    // Chrome 147+: if the navigate target is a more-private tier
    // than the SW registration, the request is blocked unless
    // the target responds with Access-Control-Allow-Private-Network: true
    try {
      await client.navigate(event.data.url);
    } catch (err) {
      // SecurityError: LNA restriction violated
      console.error('navigate blocked:', err);
    }
  }
});

references

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗