Local Network Access Restrictions

concepts

1. Preflight Inspector

   Step through the Private Network Access preflight flow — the headers Chrome sends, the headers your local server must return, and what happens when they are missing. Fully interactive with annotated request and response panels.

2. Network Boundary Tester

   Probe common local addresses (localhost, 127.0.0.1, 192.168.1.1) and observe how Chrome reports PNA blocking. Shows which requests are rejected, which succeed, and how to read the console error messages Chrome produces.

3. LNA Policy Builder

   Configure your request origin and target network tier, then get the exact Access-Control-Allow-Private-Network response headers your server must send. Covers fetch, WebSocket, WebTransport, and Service Worker navigate scenarios.

4. Attack Surface Visualizer

   Clickable network diagram from public internet to router to LAN devices (printer, camera, smart TV, NAS, localhost). Click any device to see the attack-analysis card: network tier, PNA preflight requirement, and protection outcome. Toggle between pre-Chrome 142 and Chrome 142 mode to see which vectors are closed by the new restrictions.

5. Compatibility Lab

   Classifies the current page's origin (public / private / loopback) and shows whether PNA enforcement is active. Displays the private IP range table with fetch outcomes. Provides the server-side Access-Control-Allow-Private-Network OPTIONS preflight handler pattern for Node.js and the client-side error-detection pattern.

why it shipped

The CORS-RFC1918 / Private Network Access spec exists to prevent malicious web pages from using the browser as a proxy to attack devices on a user's local network — home routers, printers, NAS devices, IoT sensors. Before PNA enforcement, a public website could silently fetch('http://192.168.1.1/api/reboot') and the router would answer. Chrome has been rolling out PNA restrictions since Chrome 94 with console warnings, opt-in trials, and preflight enforcement in stages. Chrome 142 advances the enforcement boundary: any non-secure public origin that tries to reach a private address without the correct preflight response gets a network error. Developers who build web apps that legitimately talk to local hardware (home automation, developer tools, printers) need to update their local server to respond to OPTIONS preflights with Access-Control-Allow-Private-Network: true.

references

• ChromeStatus entry
• Private Network Access spec (WICG)
• Chrome Developers — PNA Preflight
• Chrome 147 release notes