Private Network Access
Browser security mechanism that blocks public web pages from talking to private IP addresses (router 192.168.x, localhost 127.x) without explicit permission.
Specified by Chrome's team as a response to CSRF against routers and local services. Before any cross-origin request to a more private address, a preflight is sent with Access-Control-Request-Private-Network; the server must respond with a permission header.
Rolling out gradually in Chrome since 2022 (with deprecation trials for backwards compatibility). Affects IoT hubs, local dev servers and home automation that previously assumed the browser wouldn't ask.