v157 · security · capability probe
Surface probe & header echo
Three real checks, in order of distance from the metal: does this browser expose the connectionAllowlist IDL attribute; does the content attribute reflect either way regardless; and — the one that matters — when this page frames a same-origin document with the attribute genuinely set, does a Sec-Required-Connection-Allowlist header actually arrive on that navigation request? The framed echo page reports what its server really received.
Status honesty: ChromeStatus lists no shipped milestone for this feature (desktop: None — early, enterprise-oriented). The Blink runtime flag is ConnectionAllowlistEmbeddedEnforcement (status experimental, with an origin-trial name of the same spelling). To try the real enforcement path on a build that carries it: launch with --enable-experimental-web-platform-features, or join the origin trial when it opens. On every other browser this page shows the honest unrestricted baseline — never a faked enforcement result.
1 · The exact IDL, probed
Probing…
| check | result | meaning |
|---|
2 · The live framed navigation
The iframe below is loaded with connectionallowlist='("https://good.example" response-origin)' set for real. Its document is served by this site's own Deno handler, which reads the incoming request headers and reports whether the requirement header was forwarded.
Waiting for the framed page's report…
3 · Sec- prefix means script cannot forge it
Because the requirement header is Sec--prefixed, it is a forbidden request header: only the user agent may set it. This button builds a real Request that tries to smuggle one in, then fetches the echo route and prints what the server actually received.
the code
// feature-detect the embedder-side surface
const supported = 'connectionAllowlist' in HTMLIFrameElement.prototype;
// set the requirement (content attribute works — but stays inert — either way)
iframe.setAttribute('connectionallowlist', '("https://good.example" response-origin)');
// an enforcing UA then sends, with the framed navigation:
// Sec-Required-Connection-Allowlist: ("https://good.example" response-origin)