--- title: Connection Allowlist: a network firewall, built into the... description: Connection Allowlist is a new WICG browser security proposal currently in Chrome origin trial (Chrome 148–151) that lets a document declare an explicit... canonical: https://daily.dev/posts/connection-allowlist-a-network-firewall-built-into-the-browser-rzzuzped8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Connection Allowlist: a network firewall, built into the browser | daily.dev og:description: Connection Allowlist is a new WICG browser security proposal currently in Chrome origin trial (Chrome 148–151) that lets a document declare an explicit... og:url: https://daily.dev/posts/connection-allowlist-a-network-firewall-built-into-the-browser-rzzuzped8 og:image: https://api.daily.dev/og/posts/rZzUzPEd8.png og:image:alt: Connection Allowlist: a network firewall, built into the browser og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Connection Allowlist: a network firewall, built into the browser **[Scott Helme](https://daily.dev/sources/scotthelme)** · 4 min read · 0 upvotes · 0 comments ## Summary Connection Allowlist is a new WICG browser security proposal currently in Chrome origin trial (Chrome 148–151) that lets a document declare an explicit allowlist of network destinations. Any outbound connection not on the list is blocked at the network layer before leaving the machine, covering fetch/XHR, WebSocket, WebTransport, DNS prefetch, navigations, redirects, and WebRTC. Unlike CSP's directive-based approach, Connection Allowlist applies a single unified boundary to all outbound connections. Redirects and WebRTC are blocked by default and require explicit opt-in. The mechanism complements CSP rather than replacing it: CSP controls content and execution, while Connection Allowlist limits where a page can send data. Violations are reported via the Reporting API using a Report-Only header for safe deployment. Report URI already collects these reports in beta. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Connection Allowlist browser feature and how does it differ from CSP connect-src? Connection Allowlist is a WICG proposal, running as a Chrome origin trial, that lets a document declare the exact destinations it can open network connections to, blocking anything else before the connection leaves the machine. Unlike CSP's connect-src and related directives, it covers all outbound connection types uniformly (fetch, WebSocket, WebTransport, navigations, redirects, WebRTC) without needing multiple separate directives. _daily.dev surfaces emerging browser security mechanisms like this for teams hardening outbound network controls._ ### Are redirects and WebRTC connections allowed by default under a Connection Allowlist policy? No, both are blocked by default. Redirects are blocked because once a request leaves the client, the destination server controls where it redirects next, so the initial URL match offers no guarantee; opting in requires redirects=allow. WebRTC is blocked because peer connections use dynamic endpoint discovery that URL patterns can't describe, and requires webrtc=allow to permit it. _Developers configuring network containment policies can track spec defaults like these via daily.dev._ ### Which Chrome versions support the Connection Allowlist origin trial? The origin trial runs from Chrome 148 through Chrome 151, after which Chrome will decide whether the feature is ready to progress toward shipping. During the trial, reporting is limited to document contexts, so dedicated, shared, and service workers are not yet covered by violation reports. _Teams timing browser security rollouts can follow origin trial windows like this one on daily.dev._ ## Similar posts on daily.dev - [Connection Allowlists origin trial: Secure your web application's network](https://daily.dev/posts/connection-allowlists-origin-trial-secure-your-web-application-s-network-gbklxf0ix) · Chrome Developers · 1 upvotes · 1 comments - [Chrome 147 Stable Released With New Restrictions, Web Printing API](https://daily.dev/posts/chrome-147-stable-released-with-new-restrictions-web-printing-api-e2s9wkee0) · Phoronix · 0 upvotes · 0 comments - [Extending supported hashes in script-src](https://daily.dev/posts/extending-supported-hashes-in-script-src-rzzrldpo4) · Chrome Developers · 0 upvotes · 0 comments - [Trustworthy JavaScript for the Open Web](https://daily.dev/posts/trustworthy-javascript-for-the-open-web-7odqn9ra4) · Mozilla Hacks · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#webdev](https://daily.dev/tags/webdev) [View this post on daily.dev](https://daily.dev/posts/connection-allowlist-a-network-firewall-built-into-the-browser-rzzuzped8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Connection Allowlist: a network firewall, built into the browser","url":"https://daily.dev/posts/connection-allowlist-a-network-firewall-built-into-the-browser-rzzuzped8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/connection-allowlist-a-network-firewall-built-into-the-browser-rzzuzped8"},"datePublished":"2026-07-08T16:13:28.894Z","dateModified":"2026-09-13T18:25:51.932Z","description":"Connection Allowlist is a new WICG browser security proposal currently in Chrome origin trial (Chrome 148–151) that lets a document declare an explicit...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/82fa161090c7f38518a19132a79d8788?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/82fa161090c7f38518a19132a79d8788?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Scott Helme","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Scott Helme","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/01acb643b26d47bab30089a607e07829","url":"https://daily.dev/sources/scotthelme"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/connection-allowlist-a-network-firewall-built-into-the-browser-rzzuzped8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,webdev","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Scott Helme","item":"https://daily.dev/sources/scotthelme"},{"@type":"ListItem","position":3,"name":"Connection Allowlist: a network firewall, built into the browser"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/connection-allowlist-a-network-firewall-built-into-the-browser-rzzuzped8#faq","mainEntity":[{"@type":"Question","name":"What is the Connection Allowlist browser feature and how does it differ from CSP connect-src?","acceptedAnswer":{"@type":"Answer","text":"Connection Allowlist is a WICG proposal, running as a Chrome origin trial, that lets a document declare the exact destinations it can open network connections to, blocking anything else before the connection leaves the machine. Unlike CSP's connect-src and related directives, it covers all outbound connection types uniformly (fetch, WebSocket, WebTransport, navigations, redirects, WebRTC) without needing multiple separate directives. daily.dev surfaces emerging browser security mechanisms like this for teams hardening outbound network controls."}},{"@type":"Question","name":"Are redirects and WebRTC connections allowed by default under a Connection Allowlist policy?","acceptedAnswer":{"@type":"Answer","text":"No, both are blocked by default. Redirects are blocked because once a request leaves the client, the destination server controls where it redirects next, so the initial URL match offers no guarantee; opting in requires redirects=allow. WebRTC is blocked because peer connections use dynamic endpoint discovery that URL patterns can't describe, and requires webrtc=allow to permit it. Developers configuring network containment policies can track spec defaults like these via daily.dev."}},{"@type":"Question","name":"Which Chrome versions support the Connection Allowlist origin trial?","acceptedAnswer":{"@type":"Answer","text":"The origin trial runs from Chrome 148 through Chrome 151, after which Chrome will decide whether the feature is ready to progress toward shipping. During the trial, reporting is limited to document contexts, so dedicated, shared, and service workers are not yet covered by violation reports. Teams timing browser security rollouts can follow origin trial windows like this one on daily.dev."}}]} ```