demo · v148 · header policy

Policy Inspector

Build the response-header policy, then run document and worker request candidates through the same allowlist rules. The browser feature is header-delivered, so this page simulates enforcement and calls out report-only and redirect edge cases explicitly.

Runtime status Connection Allowlists are delivered by Connection-Allowlist or Connection-Allowlist-Report-Only response headers. There is no navigator.connectionAllowlist setter; this page classifies requests in JavaScript because this demo document is not served with an enforcing header.

URL patterns, one per line

candidate connections

generated response header


    

  


  

    
verdict

    

      
    
    
    
  
    

  
    
    
    implementation notes
    

    // Server response header, not a JavaScript setter:
Connection-Allowlist:
  (response-origin "https://api.example.com" "https://*.cdn.example.com");
  redirects=block; webrtc=block; report-to=network

// The policy is stored with the document's policy container.
// Workers created by the document inherit that policy.
    
  
    

  
    
    
    references
    
    
  
    

  
    
    
    implementation reference
    
    
    Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗