Inquiry About Chrome Origin Trials Extension and Future Availability

[jojo19870610]

Dear Chrome Origin Trials Team,

I hope this message finds you well. I recently applied for an extension of the Chrome Origin Trials, but I noticed that the trial period is only extended until March 18th. I am writing to inquire whether this feature will no longer be available after this date, or if there are any plans to extend it further or make it a permanent feature.

Your clarification on this matter would be greatly appreciated, as it will help me plan accordingly for my project's development and testing phases.

Thank you for your time and assistance. I look forward to your response.

Best regards,  
Yuan Li

[RBastianini]

I'm not a Chrome member team, but I've been following the Private Network Access effort. I have noticed that with recent Chrome versions (I think 133+) you no longer need to have the origin trial headers to successfully make requests to the local network.... I have tried this on Windows, Mac, Linux and Android, so as long as you are on an updated browser, I think the origin trial is not needed.

[christhompson]

Hi -- I'm the Chrome engineer who is now coordinating our PNA efforts. We let the origin trial expire and Chrome is not currently enforcing these restrictions -- see https://groups.google.com/a/chromium.org/g/blink-dev/c/NCV3anf1KtU/m/WyL9rKjtAQAJ for some more details. We are beginning work on a somewhat simplified version of these restrictions we are referring to as "Local Network Access" and will be doing more outreach soon. If you were previously compatible with Private Network Access, you should be generally compatible with Local Network Access. We also plan to have a similar reverse origin trial for temporarily opting out of the secure context restriction.

For more details, see our new ChromeStatus entry or our explainer for Local Network Access. We plan to have more developer-facing documentation soon as well.

[jub0bs]

@christhompson I am the author of a CORS library for Go that supports PNA. I only realised today that some (all?) PNA features (esp. preflight checks) have been expunged from modern versions of Chromium.

Could you please confirm that, although similar efforts under the LNA project are ongoing, PNA as specified by https://wicg.github.io/private-network-access/ (i.e. based on HTTP headers) is dead and buried? If so, is there any official announcement of the decision to kill PNA besides the comment you linked to?

I'd like to be absolutely certain that I can remove the relevant code from my library.

cc @letitz

[christhompson]

@jub0bs We are still working on getting the new LNA project to a state where we can announce it is ready for Dev Trial, and we will have more communications soon (at minimum: a blog post and more comms on blink-dev). We are no longer actively working on PNA, but we have not yet removed all of the implementation in Chrome (we had some complicated rollout requirements due to some users relying on force-enabling the existing PNA implementation).

I obviously can't make a guarantee, but you should be safe to remove support at this point as preflight enforcement has never been enabled by default in Chrome (the feature flags to manually force it on do still exist at this point in time though) -- we'll have more official communications soon as our first milestone of LNA is almost feature complete.

Thank you for your active engagement with the PNA effort in the past! This has been a long process but we are hopeful that our refocused effort will be able to launch (with cross-browser buy-in) and improve the security of the web for our users.

[jub0bs]

@christhompson Thanks for your reply, and good luck on the LNA project.

The status of PNA should be clarified as soon as possible, in this repo's README or on https://wicg.github.io/private-network-access/ or both; perhaps this repo should also be archived. I'm guessing that, when the project's status becomes clear, maintainers of other CORS libraries will want to mark their PNA settings as deprecated.

[jub0bs]

@christhompson

we'll have more official communications soon as our first milestone of LNA is almost feature complete.

Any rough ETA for this?

[christhompson]

@jub0bs We put out our blog post earlier this week announcing our plans and including details about how developers can test: https://developer.chrome.com/blog/local-network-access