WICG

private-network-access

HTML2021–2025

WICG / private-network-access

private-network-access

Discover this repository through its Hacker News conversations.

Systems & Infrastructure Networking

Explore on GitHub Read Hacker News discussions

6Distinct people

6Mentions

0Explicit recommenders

69GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

A public description has not been verified.

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year6 dated mentions

Observed mentions: 2021-10-25 10:47:27 UTC to 2025-08-20 11:47:01 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Comments
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	2	2
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	0	0
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	0	0
2024	2024-01-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	1	1
2025	2025-01-01 00:00:00 UTC	2026-01-01 00:00:00 UTC	3	3

What Hacker News says

6 sources

JJJollyjim·Aug 20, 2025

Chrome doesn't allow it - local network services have to opt-in to being fetchable from public sites (https://github.com/WICG/private-network-access), although they're replacing it with a user-permission-based approach (https://github.com/WICG/local-network-access). (There is some language online suggesting PNA has not actually shipped, but I experienced it myself in stable Chrome several years ago, so I am unsure of the current state). Firefox doesn't implement either approach -- I assume this is indicative of their lack of development resources.

In Ask HN: Why does the US Visa application website do a port-scan of my network?

rcxdude·Jun 6, 2025

HTTPS, basically. I've gone around and around in circles on this for a device I work on. You'd like to present an HTTPS web UI, because a) you'd like encryption between the UI and the device, and b) browsers lock down a lot of APIs, sometimes arbitrarily, behind being in a 'secure context' (ironically, including the cryptography APIs!). But your device doesn't control it's IP address or hostname, and may not even have access to the internet, so there's no way for it to have a proper HTTPS certificate, and a self-signed certificate will create all kinds of scary warnings in the browser (which HTTP will not, ironically). So manufacturers create all kinds of crazy workarounds, like plex's, to be able to present an HTTPS web page that is easily accessible and can just talk to the device. (Except it's still not that simple, because you can't e

Read the rest

asily make an HTTP request from an HTTPS context, so plex also jumps through a bunch of hoops to co-ordinate some HTTPS certificate for the local device, which requires an internet connection). It's a complete mess, and browsers really seem to be keen on blocking any 'let HTTPS work for local devices' solution, even if it were just a simple upgrade to the status quo that would otherwise just be treated like HTTP. Nor will they stop putting useful APIs behind a 'secure context' like an HTTPS certificate implies any level of trust except that a page is associated with a given domain name. (Someone at plex seems to have finally gotten through to some of the devs at Chrome, and AFAIK there is now a somewhat reasonable flow that would allow e.g. a progressive webapp to request access to a local device and communicate with it without an HTTPS certificate, which is something, but still way to just host the damn UI on the device without limiting the functionality! And it's chrome-only, maybe still in preview? Haven't gotten around to trying to implement it yet) See this long, painful, multi-year discussion on the topic: https://github.com/WICG/private-network-access/issues/23

In A proposal to restrict sites from accessing a users’ local network

emushack·Jun 5, 2025

They define it the explainer this was originally based on: (https://github.com/WICG/private-network-access/blob/main/exp...) Quote: We extend the RFC 1918 concept of private IP addresses to build a model of network privacy. Concretely, there are 3 kinds of private network requests: public -> private public -> local private -> local

In A proposal to restrict sites from accessing a users’ local network

LegionMammal978·Aug 24, 2024

My biggest gripe with CORS is how the destination site needs to opt into it for requests of every kind. For instance, by default a cross-origin XMLHttpRequest or fetch() request will not include cookies, and if you ask it to include cookies, then the destination must include an Access-Control-Allow-Credentials header if you want the browser to allow it. So that's all well and good, except for the part where even requests without cookies still need an explicit Access-Control-Allow-Origin in the response. As far as I am aware, the only attack vector this protects against is when the destination decides to release sensitive information solely based on the IP address of the source, and not based on its cookies or any other information not already accessible to JS. (Obviously, the biggest instance of this is in the case of local network addres

Read the rest

ses, but there are efforts to further restrict cross-origin requests to such addresses, using a separate header, Access-Control-Allow-Private-Network [0].) I find this a shame, since it means that it's impossible to download most public data in a web app without proxying it through your own server, just because of this one edge case. [0] https://github.com/WICG/private-network-access

In CORS Is Stupid

xg15·Nov 16, 2021

Linked in the Private Network Access draft is a discussion which outlines some general points about HTTPS on local devices and participation of local devices on the web in general. It's interesting to read, even though the results seem rather bleak. https://github.com/wicg/private-network-access/issues/23

In Chrome may start restricting requests to private networks

noduerme·Oct 25, 2021

There are fantastic reasons why it should not be allowed on random local devices, unless the local device is configured with some sort of authentication... but the problem now is that total ban on accessing local devices from a secure web app is a serious choke point for anyone trying to develop something to control appliances outside the walled garden. Fascinating discussion here with a Plex dev expressing similar frustrations with the general direction of these context barriers... which in their case affects millions of users and threatens to pull down their entire platform. Their solution currently is bizarre; they actually have to hijack DNS resolution and issue SSL certs on the fly for each of their users' servers to allow their web app to connect to a local node. Not possible in my smaller corporate sphere. https://github.com/WICG/p

Read the rest

rivate-network-access/issues/23

In Node-RED: Low-code programming for event-driven applications