Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support Private Network Access (RFC1918) #793

Open
codedread opened this issue Feb 12, 2022 · 3 comments · May be fixed by #801
Open

Support Private Network Access (RFC1918) #793

codedread opened this issue Feb 12, 2022 · 3 comments · May be fixed by #801

Comments

@codedread
Copy link

codedread commented Feb 12, 2022

What's the problem this feature will solve?

See this doc. Eventually public websites that hit local addresses will require the server to respond to a pre-flight request for the Access-Control-Request-Private-Network header. http-server should support an option for this like it does for --cors.

Describe the solution you'd like

--private-network-access (or something better named) should respond to these pre-flight requests appropriately with Access-Control-Request-Private-Network: true.

Alternative Solutions

I'm not sure there are any, if this RFC is put into play by all browsers.

Additional context

@codedread
Copy link
Author

https://developer.chrome.com/blog/private-network-access-update/ talks about Chrome's timeline for this

@github-actions
Copy link

This issue has been inactive for 180 days

@github-actions github-actions bot added the stale label Aug 11, 2022
@manemal
Copy link

manemal commented Sep 26, 2022

Chrome 105 seems to now be actively blocking PNA (localhost in a development workflow). Until this issue is picked up, and purely as a temporary stop-gap, I added the following to allow continuing my debug workflow https://github.com/http-party/http-server/blob/master/lib/http-server.js#L102

this.headers['Access-Control-Allow-Private-Network'] = 'true';

This is purely a temporary solution for anyone with a similar debug/local dev workflow need and nothing more. As the OP specified, this should be controlled via the inclusion of the Access-Control-Request-Private-Network header in the request.

@github-actions github-actions bot removed the stale label Sep 26, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants