v151 · Permissions Policy · Direct Sockets

Feature Comparison

Before Chrome 151, three separate Permissions Policy directives controlled private network socket access: direct-sockets-private, local-network, and loopback-network. After the merge, they are unified. This page shows the old header/attribute patterns side-by-side with the new merged equivalents.

Directive status after Chrome 151

Directive

Pre-151

Chrome 151+

direct-sockets-private

Separate directive

Unified anchor

local-network

Separate directive

Merged into dsp

loopback-network

Separate directive

Merged into dsp

Before Chrome 151 — 3 separate directives

# HTTP Response Header
Permissions-Policy: direct-sockets-private=(),
    local-network=(),
    loopback-network=()

<!-- iframe allow -->
<iframe allow="direct-sockets-private 'none';
    local-network 'none';
    loopback-network 'none'"></iframe>

Three directives must be listed separately. Easy to forget one and leave a gap.

Chrome 151 — merged directive

# HTTP Response Header
Permissions-Policy: direct-sockets-private=()

<!-- iframe allow -->
<iframe allow="direct-sockets-private 'none'">
</iframe>

# local-network and loopback-network are
# automatically blocked via the merged rule

One directive controls all three. No risk of accidentally leaving a gap.

Before Chrome 151

Permissions-Policy:
  direct-sockets-private='self',
  local-network='self',
  loopback-network='self'

Chrome 151

Permissions-Policy:
  direct-sockets-private='self'

# self implied for local-network
# and loopback-network automatically

Before Chrome 151

# Top-level header
Permissions-Policy:
  direct-sockets-private=(self "https://partner.example"),
  local-network=(self "https://partner.example"),
  loopback-network=(self "https://partner.example")

<!-- Frame -->
<iframe src="https://partner.example/app"
  allow="direct-sockets-private;
         local-network;
         loopback-network"></iframe>

Chrome 151

# Top-level header
Permissions-Policy:
  direct-sockets-private=(self "https://partner.example")

<!-- Frame -->
<iframe src="https://partner.example/app"
  allow="direct-sockets-private"></iframe>

# Partner automatically gets
# local-network + loopback-network access too

Before Chrome 151

// IWA manifest — three entries
{
  "permissions_policy": {
    "direct-sockets-private": ["self"],
    "local-network": ["self"],
    "loopback-network": ["self"]
  }
}

IWA manifests must list all three separately.

Chrome 151

// IWA manifest — one entry
{
  "permissions_policy": {
    "direct-sockets-private": ["self"]
  }
}

// local-network and loopback-network
// follow automatically via merge

Single entry is sufficient. Manifest is shorter and less error-prone.

Migration note: If you already list all three directives in your headers, the old syntax still works in Chrome 151 — the merged rule is additive, not a rename. No breakage. However, you can simplify to just direct-sockets-private and remove the other two to keep headers clean.

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗

see also

implementation reference