v147 · Security · demo

Network Boundary Tester

Attempt fetch requests to localhost, loopback, and private IP ranges and observe Chrome's Private Network Access enforcement — which requests trigger preflights, which are blocked, and what error messages appear.

How this works: Each probe calls fetch(url, { signal: AbortSignal.timeout(3000) }). A PNA block produces a TypeError with a message about CORS policy. A timeout means the address is unreachable (no server running). An actual response means a server exists and responded to the PNA preflight correctly.

Test a custom URL:

Probe log

—Click "Probe all targets" to start

// What Chrome does when you fetch a private address from a public page:
try {
  const res = await fetch('http://192.168.1.1/api/status', {
    signal: AbortSignal.timeout(3000),
  });
  console.log('Response:', res.status); // only if PNA preflight passed
} catch (e) {
  if (e.name === 'TypeError') {
    console.error('PNA blocked or CORS error:', e.message);
  } else if (e.name === 'TimeoutError') {
    console.warn('No server at this address (timeout)');
  }
}

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗

see also

implementation reference