Seems like a minor incremental risk on top of the broader LNA feature. Thank you for being careful via experimentation and feedback! LGTM for finch pre-stable (or up to 1% stable if you decide you need it for some reason).
On Tue, Oct 14, 2025 at 10:44 AM Hubert Chao <[email protected]> wrote: > > *Note: this is for pre-stable experimentation through Finch, not for an > Origin Trial. The current LNA reverse origin trial > <https://developer.chrome.com/origintrials/#/view_trial/3826370833404657665> > will apply here as well.(Plan is to follow the same LNA launch cycle of > pre-stable experimentation followed by 100% stable launch)* > > *Contact emails* > [email protected] > > *Explainer* > > https://github.com/WICG/local-network-access/blob/main/explainer.md#websockets > > *Specification* > https://wicg.github.io/local-network-access/#integration-with-websockets > > *Summary* > Restricts the ability to make requests to the user's local network using > WebSockets, gated behind a permission prompt. A local network request is > any request from a public website to a local IP address or loopback, or > from a local website (e.g. intranet) to loopback. Gating the ability for > websites to perform these requests behind a permission reduces the ability > of sites to use these requests to fingerprint the user's local network. > This permission is restricted to secure contexts. This work is adding to > the Local Network Access Restrictions work here: > https://chromestatus.com/feature/5152728072060928 > > *Blink component* > Blink>SecurityFeature>LocalNetworkAccess > <https://issues.chromium.org/issues?q=customfield1222907:%22Blink%3ESecurityFeature%3ELocalNetworkAccess%22> > > *Web Feature ID* > local-network-access <https://webstatus.dev/features/local-network-access> > > *TAG review* > None > > *TAG review status* > Pending > > *Risks* > > > *Interoperability and Compatibility* > Interoperability risks: LNA requires a Secure Context to make local > network requests, but exempts some of these local network requests from > mixed content checks (if the user grants permission). If another browser > does not implement LNA, these same local network requests might be blocked > as mixed content, or the site might need to serve over HTTPS for Chrome and > over HTTP for browsers that don't implement LNA (to avoid triggering mixed > content). Compatibility risks: There are some local network requests types > that we cannot know ahead of time will be going to the local network (e.g., > a subresource request to http://test.example which then resolves to > 192.168.0.1). These would be blocked as mixed content, as mixed content > checks happen before hostname resolution (i.e., they occur before "Obtain a > connection" in Fetch). Explicit local IP addresses, and `.local` domains > are exempted from mixed content checks, but we do not have an equivalent to > the `targetAddressSpace` fetch() option for WebSockets We hope that our Dev > Trial will help identify compatibility issues. The LNA reverse origin trial > will provide a temporary opt-out for those that are not able to bypass the > mixed content checks currently > > *Gecko*: No signal > > *WebKit*: No signal > > *Web developers*: Mixed. Mostly the same as for the baseline LNA > restrictions, though with a slightly different audience. Some developers > are looking for ways to pre-grant the permission (see this issue > <https://github.com/WICG/local-network-access/issues/44> and this issue > <http:///> > > *Other signals*: > > *Activation* > A new permission will be shown to users, which may be unexpected, and if > users deny the permission functionality may break (potentially requiring > additional support from site owners). As this is building off of the first > Local Network Access launch, this should be a minimal risk, but has a > chance of impacting those who are impacted by this launch but were not > impacted by the original Local Network Access launch. > > *WebView application risks* > > Does this intent deprecate or change behavior of existing APIs, such that > it has potentially high risk for Android WebView-based applications? > None > > > *Goals for experimentation* > > > *Ongoing technical constraints* > None > > *Debuggability* > None > > *Will this feature be supported on all six Blink platforms (Windows, Mac, > Linux, ChromeOS, Android, and Android WebView)?* > NoThis is unsupported on WebView for the same reasons that Local Network > Access is unsupported on WebView > > *Is this feature fully tested by web-platform-tests > <https://chromium.googlesource.com/chromium/src/+/main/docs/testing/web_platform_tests.md>?* > No > > > *DevTrial instructions* > > https://docs.google.com/document/d/1GHbpRTCnfDXq9o8WKyrG7oPAiWC6Yozac-PvbfO3KoY/edit?usp=sharing > > *Flag name on about://flags* > local-network-access-check-websockets > > *Finch feature name* > LocalNetworkAccessChecksWebSockets > > *Requires code in //chrome?* > False > > *Tracking bug* > https://crbug.com/421156866 > > *Measurement* > Use counters: - PrivateNetworkAccessWebSocketConnected counts the number > of LNA WebSockets request we see - > LocalNetworkAccessWebSocketResourceNotKnownPrivate - counts cases in which > a `targetAddressSpace` option could have helped bypass mixed content checks > > *Estimated milestones* > DevTrial on desktop 142 > DevTrial on Android 142 > > *Link to entry on the Chrome Platform Status* > https://chromestatus.com/feature/5197681148428288?gate=5091697260363776 > > *Links to previous Intent discussions* > Intent to Prototype: > https://groups.google.com/a/chromium.org/d/msgid/blink-dev/68b9e717.050a0220.3291f8.09fe.GAE%40google.com > > > This intent message was generated by Chrome Platform Status > <https://chromestatus.com/>. > > -- > You received this message because you are subscribed to the Google Groups > "blink-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion visit > https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAHEiSH2ujeQQ0jJw1eYb-WfS1Ozw%2Bc4%2BX%2BrSxTD%2B524wMYbknQ%40mail.gmail.com > <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAHEiSH2ujeQQ0jJw1eYb-WfS1Ozw%2Bc4%2BX%2BrSxTD%2B524wMYbknQ%40mail.gmail.com?utm_medium=email&utm_source=footer> > . > -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAFUtAY_4Ma5BjhHPhCdG9xOKyA%2B-jnbLGH5uFOJkUxty8LGYRw%40mail.gmail.com.
