Restrict "private network requests" for subresources from public websites to secure contexts.

Category: Security
Type: Feature removal
Status: Origin trial (Chrome 127)
Intent stage: Origin Trial

Summary

Requires that private network requests for subresources from public websites may only be initiated from a secure context. Examples include internet to intranet requests and internet to loopback requests. This is a first step towards fully implementing Private Network Access: https://wicg.github.io/private-network-access/

Motivation

Servers running inside local networks, or on a user's device, expose powerful capabilities to the web in ways that can be quite dangerous. Private Network Access proposes a set of changes to limit the impact of requests to these servers by ensuring that the servers are opting-into any communication with external entities. For this opt-in to have any meaning, the servers need to be able to ensure that the client origin is authenticated. To that end, only secure contexts are empowered to make external requests. This change is separable from the rest of Private Network Access, and we can make it now, before the rest of the larger feature is ready.

Standards & signals

Specification: https://wicg.github.io/private-network-access
Firefox: Positive — Tentatively positive, but no formal position yet.
Safari: Positive
Web developers: Mixed signals — In our recent survey, most of websites are able to migrate if our new permission prompt can be landed as a way for them to relax mixed content checks. https://docs.google.com/spreadsheets/d/1z5ZdCslNCnSVR7TNlUTHjSvunMFmT_9G9NOx8-O78-I/edit?resourcekey=0-DITlG8tDuFDWHiBUHnlSoQ#gid=309953809 ------------ Some websites, broadly falling in the category of controller webapps for IoT devices, find this change incompatible with their use cases. While many use cases can be solved with specific workarounds, some still require further engagement.
Tracking bug: https://crbug.com/986744

Docs: https://docs.google.com/document/d/1x1a1fQLOrcWogK3tpFBgQZQ5ZjcONTvD0IqqXkgrg5I/edit#heading=h.7nki9mck5t64

Explainers: https://github.com/WICG/private-network-access/blob/master/explainer.md

View on chromestatus.com