SITES-51937: Add allow="local-network-access" to extension iframes - #155
Merged
Merged
Conversation
Chrome's Local Network Access checks silently block requests from extension iframes when the author-* host resolves to a private/CGNAT IP (e.g. some corporate proxies/BYOD setups) -- no permission prompt is shown, just a net::ERR_BLOCKED_BY_LOCAL_NETWORK_ACCESS_CHECKS in the console. requiredIframeProps in iframe-normalizers.ts is the single place both the guest server frame (port.ts's connect()) and the guest UI frame (GuestUIFrame.tsx) get their iframe attributes from, so adding it there covers every iframe uix-host creates for extensions. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Unit tests only proved the attribute string was set on a jsdom node. Add TestCafe assertions against the actual rendered iframes in e2e/host-app: the visible GuestUIFrame (#iframe-for-guest) and the hidden guest-server frame (identified by aria-hidden="true", which only that frame sets), so a build step that strips the attribute would be caught here too. Verified both new assertions actually catch a regression: reverted the allow: "local-network-access" line in iframe-normalizers.ts, rebuilt, and re-ran against the live apps -- both failed with "expected local-network-access, got null". Restored the fix and re-ran clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
grubyak
approved these changes
Sep 21, 2026
kokoc
approved these changes
Sep 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Sets
allow="local-network-access"on every iframeuix-hostcreates for extensions (both the hidden guest-server frame and the visible guest-UI frame), by adding it torequiredIframePropsinpackages/uix-host/src/dom-utils/iframe-normalizers.ts-- the single place both iframe types get their attributes from (port.ts'sconnect()/attachFrame()vianormalizeIframe(), andGuestUIFrame.tsxvia spreadingrequiredIframeProps).Motivation and Context
Related to SITES-48168. When a user's network resolves the
author-*host to a private/CGNAT IP (e.g. Zscaler for BYOD users), Chrome's Local Network Access feature silently blocks requests from UE's extension iframes to that host -- confirmed via HAR showing repeatednet::ERR_BLOCKED_BY_LOCAL_NETWORK_ACCESS_CHECKSerrors, with no permission prompt shown.Since
requiredIframePropsis spread/applied last (after any consumer-provided props), this requiredallowvalue intentionally wins over any customallowa host app might pass -- same precedent as the other required props (data-uix-guest,role,referrerPolicy). No existing usage of a customallowprop exists anywhere in this repo's examples/e2e apps today, so this isn't expected to break anyone.Related Issue
SITES-51937
How Has This Been Tested?
npx jest packages/uix-host/src/dom-utils/iframe-normalizers.test.ts-- updated inline snapshot confirmsnormalizeIframe()now setsallow="local-network-access"(this covers the guest-server frame path).GuestUIFrame.test.tsxconfirming the rendered guest-UI iframe getsallow="local-network-access", including when a consumer passes a conflicting customallowprop.npm run lint && npm run test:unit-- 15/15 suites, 87 tests (85 passed + 2 pre-existing skipped), 0 failing.Types of changes
Checklist
Follow-up (per ticket's acceptance criteria)
Once this merges and ships in a release, update SITES-48168 with the
uix-*version that carries the fix, so it can be verified there.🤖 Generated with Claude Code