📝 [Proposal]: Add Support for the Private Network Access CORS Header Access-Control-Request-Private-Network

[GalvinGao]

Feature Proposal Description

Add CORS Middleware Support for the Private Network Access CORS Header Access-Control-Request-Private-Network to avoid additional preflight/timeout time cost.

Alignment with Express API

Express.js's CORS middleware has not been updated yet.

HTTP RFC Standards Compliance

• Private Network Access: introducing preflights
• Private Network Access (W3C Draft Report) (Previously known as CORS-RFC1918)

API Stability

It seems that Chrome 104 has already shipped this header.

Feature Examples

app.Use(cors.New(cors.Config{
    AllowPrivateNetworkAccess: true,

    // other already existing fields omitted...
}))

Example Request

OPTIONS /path HTTP/1.1
Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Private-Network: true
Origin: https://example.com
Sec-Fetch-Mode: cors

Expected Response for the Example Request

HTTP/1.1 204 No Content
Access-Control-Allow-Private-Network: true
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,HEAD,PUT,DELETE,PATCH

Checklist:

• I agree to follow Fiber's Code of Conduct.
• I have searched for existing issues that describe my proposal before opening this one.
• I understand that a proposal that does not meet these guidelines may be closed without explanation.

[Behzad-Khokher]

This is really interesting. But I was just curious how are we avoiding pre-flight requests in this case. To access a private resource wouldn't the browser still need to make an [options] pre-flight request with the header Access-Control-Request-Private-Network: true for the server would respond with Access-Control-Allow-Private-Network: true.

What I'm confused about is that isn't it up to the browser to decide automatically when a pre-flight request needs to be sent. Either way, it would be sending a pre-flight request any way? So how are we avoiding additional pre-flights?

[the-hotmann]

@Behzad-Khokher
here the blogpost from Google, on how it works: https://developer.chrome.com/blog/private-network-access-preflight

[ReneWerner87]

sure we can do this

[Behzad-Khokher]

@ReneWerner87 I can look into this. May I self assign?

[ReneWerner87]

Thx

[sixcolors]

This is still in draft and has not been accepted as a standard. https://wicg.github.io/private-network-access/

recommend against adding at this time.

[gaby]

Fixed via #2908 will be a new festure in Fiber v3