Sends a CORS preflight request ahead of any private network requests for subresources, asking for explicit permission from the target server. A private network request is any request from a public website to a private IP address or localhost, or from a private website (e.g. intranet) to localhost. Sending a preflight request mitigates the risk of cross-site request forgery attacks against private network devices such as routers, which are often not prepared to defend against this threat.


Private network services are often ill-equipped to deal with cross-site request forgery attacks carried out by malicious code running in users' browsers. These attacks have been used to compromise the security of hundreds of thousands of users around the world. Private Network Access proposes to solve this problem by: 1. Requiring that private network requests be initiated by secure contexts. 2. Sending an augmented CORS preflight request before the actual request. Together, this ensures that private network devices must explicitly opt into receiving subresource requests from secure and authenticated public websites.



Specification link

Specification being incubated in a Community Group

Status in Chromium


Enabled by default (tracking bug)

Consensus & Standardization

After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.


Intent to Prototype url

Intent to Prototype thread


LGTMs valid for step 1 only: sending preflights without enforcement.

Last updated on 2022-01-10