← Back to release summary

Local Network Access restrictions on Service Worker WindowClient.navigate()

Category
Security
Type
New or changed feature
Status
Proposed (Chrome Proposed)
Intent stage
None

Summary

Local Network Access (LNA) restrictions have been recently added in the last few months to restrict web sites from unilaterally making requests to local networks and local devices (https://chromestatus.com/feature/5152728072060928). This was added for Service Worker-initiated fetch requests, but was not done for navigations done by service workers through WindowClient.navigate This launch closes this hole by adding LNA restrictions to WindowClient.navigate() calls, using the WindowClient as the initiator of the navigation to determine if the navigation is an LNA request. This only applies if the WindowClient being navigated is a subframe; Chrome does not currently enforce any LNA restrictions on main frame navigations.

Standards & signals

View on chromestatus.com