v147 · Security · demo

Preflight Inspector

Step through the four scenarios Chrome encounters when a public page tries to fetch a private-network resource — and see exactly which headers make the difference between blocked and allowed.

// What a private-network server MUST respond to OPTIONS preflight:
app.options('/api/data', (req, res) => {
  res.setHeader('Access-Control-Allow-Origin',          req.headers.origin);
  res.setHeader('Access-Control-Allow-Methods',         'GET, POST');
  res.setHeader('Access-Control-Allow-Private-Network', 'true'); // ← required
  res.status(204).end();
});

// Without that header, Chrome blocks the actual GET request.

see also

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗