Permission Policy Merger: direct-sockets-private with local-network and loopback-network

background

The Direct Sockets API allows Isolated Web Apps (IWAs) to open raw TCP/UDP sockets directly to private network addresses. Previously, three separate Permissions Policy directives controlled access: direct-sockets-private (for private ranges), local-network, and loopback-network.

Chrome 151 merges direct-sockets-private into the local-network and loopback-network directives, reducing the number of headers needed and aligning with the Local Network Access permission model.

concepts

1. Policy Demo

   Shows the Permissions Policy headers before and after the merger, and demonstrates feature detection for direct socket access.

2. Migration Guide

   How to update existing Permissions Policy headers when migrating from direct-sockets-private to the merged local-network / loopback-network directives.

3. Policy Header Builder

   Toggle which directives to grant and instantly generate the correct Permissions-Policy header for both old Chrome (with direct-sockets-private) and Chrome 151+ (merged into local-network and loopback-network). A live feature detection panel shows which directives are actually allowed on this page.

4. Iframe Policy Inspector

   An interactive tree of a top frame plus three nested iframes. Toggle the parent Permissions-Policy header values, edit each iframe's allow="" attribute, and watch the effective policy propagate down — visualising how intersection works for each directive.

5. Policy Inheritance Explorer

   Configure the top-level HTTP header and each nested iframe's allow="" attribute via dropdowns, then watch the merged direct-sockets-private policy flow through a three-level frame tree. A table shows ALLOWED / DENIED per directive at every level.

6. Feature Comparison

   Four tabbed scenarios (block all, allow self, allow trusted iframe, IWA manifest) each shown side-by-side: the old three-directive syntax versus the new single merged directive. Includes a migration note on backward compatibility.

7. Header Echo Lab

   Build a merged Chrome 151 policy, fetch a live route that returns the matching Permissions-Policy response header, and compare it with the transitional header older Chrome versions may still need.

the change

# Before Chrome 151: separate directives
Permissions-Policy: direct-sockets=*, direct-sockets-private=*, local-network=*

# Chrome 151+: direct-sockets-private merged into local-network + loopback-network
# Use these instead:
Permissions-Policy: direct-sockets=*, local-network=*, loopback-network=*

# In JavaScript (Isolated Web Apps only):
const { readable, writable } = await navigator.openTCPSocket({
  remoteAddress: '192.168.1.100',  // private range
  remotePort: 8080,
});
// Requires: local-network policy + IWA context

references

• ChromeStatus entry
• MDN — Permissions Policy
• Direct Sockets specification