← Back to release summary

RemoveTreatAsPublicAddress

Category
Security
Type
Feature removal
Status
Proposed (Chrome Proposed)
Intent stage
None

Summary

The Content Security Policy header treat-as-public-address was added as part of Private Network Access to allow non-documents to declare themselves as being in the public address space (https://wicg.github.io/private-network-access/#csp). It is primarily useful for testing. https://github.com/WICG/private-network-access/issues/88 highlights some issues with this header, and the decision was made to remove this header instead of moving it somewhere else. For testing use cases, the --ip-address-space-overrides command line flag can be used. This header was only ever implemented in Chromium; Firefox has never implemented this header and has no plans to. Safari has not implemented Private Network Access or Local Network Access and so does not have the header either.

Motivation

Header does not fit well into Content Security Policy, and it was deemed unnecessary given the alternative of using `--ip-address-space-overrides` Metrics show this is barely used: https://chromestatus.com/metrics/feature/timeline/popularity/5983

Standards & signals

Ecosystem

View on chromestatus.com