https://portswigger.net/daily-swig/chrome-to-bolster-csrf-protections-with-cors-preflight-checks-on-private-network-requests The Daily Swig [ ] ( ) ( ) ( ) ( ) ( ) ( ) ( ) ( ) Regions Hacking News Data Breaches Cyber-attacks Vulnerabilities Bug Bounties More About Africa Asia Europe Middle East Latin America North America Oceania View all US news APT focus Take a closer look at Iran's state-sponsored hacking groups Regions Latest Hacking News Hacking Tools Hacking Techniques Pen Testing Cloud Security Database Security Email Security Network Security View all hacking news Hacker-powered security Human error bugs increasingly making a splash, study indicates Hacking news Latest Data Breaches Data Leak Organizations Enterprise Security View all data breach news In focus Software supply chain attacks - everything you need to know Data Breaches Latest Cyber-attacks Cybercrime Cyber Warfare DDoS Attacks Supply Chain Attacks View all cyber-attack news Special report North Korean cyber-threat groups become top-tier adversaries Cyber Attacks Latest Vulnerabilities Zero-Day News RCE XSS SQL Injection SSRF CSRF XS Leaks View all security vulnerability news What's in a (domain) name? How expired web domains are helping criminal hacking campaigns Vulnerabilities Bug Bounty News VDP News Research OSINT View all bug bounty news Bug Bounty Radar The latest programs for January 2022 Bug bounties Interviews Analysis Research Deep Dives Browsers Ransomware Phishing Malware Encryption Privacy Mobile IoT Policy and Legislation Machine learning DNS Open Source Hardware Authentication Events View all infosec industry news Cybersecurity conferences A schedule of events in 2021 and beyond More topics Chrome to bolster CSRF protections with CORS preflight checks on private network requests Adam Bannister 18 January 2022 at 15:35 UTC Updated: 18 January 2022 at 15:39 UTC Chrome Browsers CSRF Twitter WhatsApp Facebook Reddit LinkedIn Email Phased rollout begins from Chrome 98 with DevTools warnings of failed preflight requests dddd Chrome is deprecating direct access to private network endpoints from public websites in order to protect users from cross-site request forgery (CSRF) attacks. Part two of the browser's implementation of the Private Network Access (PNA) specification, the move is specifically designed to block CSRF assaults that target routers and other devices on private networks. "These attacks have affected hundreds of thousands of users, allowing attackers to redirect them to malicious servers," explained Chrome software engineer Titouan Rigoudy and Google developer advocate Eiji Kitamura in a blog post. Preflight screening A two-part phased rollout of the change will begin with Chrome 98 - expected to land in early February - sending Cross-Origin Resource Sharing (CORS) preflight requests ahead of private network subresource requests. RELATED Same-origin violation vulnerability in Safari 15 could leak a user's website history and identity Regardless of the private network request's method and mode, the preflight requests will request permission from target websites to send HTTP requests with the header Access-Control-Request-Private-Network: true. If permission is granted, the response will carry the header Access-Control-Allow-Private-Network: true. "This ensures that the target server understands the CORS protocol and significantly reduces the risk of CSRF attacks," said Rigoudy and Kitamura. Phased rollout Preflight failures will trigger warnings in DevTools without otherwise affecting private network requests. However, from Chrome 101 at the earliest - contingent on the results of first-phase compatibility data and first contacting the largest affected websites - rejected preflight requests will be blocked. Web admins can test whether their websites will work after this second phase with a command-line argument - Access-Control-Allow-Private-Network: true - that generates failed fetches for unsuccessful preflight requests. Catch up with the latest browser security news Although the Chrome team does not expect the first phase to break any websites, they nevertheless urge webmasters to update affected request paths by handling preflight requests on the server side or disabling PNA checks with enterprise policies. A deprecation trial lasting at least six months will begin at the outset of phase two to allow affected websites to request a time extension. PNA implementation timeline Formerly known as CORS-RFC1918, PNA restricts the ability of websites to send requests to servers on networks that are more private than the network from which the request is initiated. Chrome has already implemented part of the specification in Chrome 96, since when only secure contexts have been permitted to make private network requests. The specification also extends the Cross-Origin Resource Sharing (CORS) protocol to require websites to explicitly request a grant from servers on private networks before being allowed to send arbitrary requests. The Chrome team is "tentatively aiming" to introduce phased rollouts for extending PNA checks further to cover dedicated, shared, and service web workers from Chrome 100, and to cover navigations, including iframes and popups, from Chrome 102. READ MORE Firefox fixes fullscreen notification bypass bug that could have led to convincing phishing campaigns Chrome Browsers CSRF Google Vulnerabilities Authentication DNS Hardware Industry News Organizations Enterprise Adam Bannister Adam Bannister @Ad_Nauseum74 Twitter WhatsApp Facebook Reddit LinkedIn Email This page requires JavaScript for an enhanced user experience. Latest Posts Breaking the Box Researchers discover 'extremely easy' 2FA bypass in Box cloud software 18 January 2022 Breaking the Box Researchers discover 'extremely easy' 2FA bypass in Box cloud software SSRF vulnerability in VMWare software could allow access to user data 18 January 2022 SSRF vulnerability in VMWare software could allow access to user data Post-authentication bug could enable an attacker to infiltrate a user account VPNLab takedown Authorities dismantle 'criminal-favorite' VPN service 18 January 2022 VPNLab takedown Authorities dismantle 'criminal-favorite' VPN service Related stories This page requires JavaScript for an enhanced user experience. Preflight checks Chrome to bolster CSRF protections by deprecating direct access to private network endpoints from public websites 18 January 2022 Preflight checks Chrome to bolster CSRF protections by deprecating direct access to private network endpoints from public websites Breaking the Box Researchers discover 'extremely easy' 2FA bypass in Box cloud software 18 January 2022 Breaking the Box Researchers discover 'extremely easy' 2FA bypass in Box cloud software SSRF vulnerability in VMWare software could allow access to user data 18 January 2022 SSRF vulnerability in VMWare software could allow access to user data Post-authentication bug could enable an attacker to infiltrate a user account VPNLab takedown Authorities dismantle 'criminal-favorite' VPN service 18 January 2022 VPNLab takedown Authorities dismantle 'criminal-favorite' VPN service Burp Suite Web vulnerability scanner Burp Suite Editions Release Notes Vulnerabilities Cross-site scripting (XSS) SQL injection Cross-site request forgery XML external entity injection Directory traversal Server-side request forgery Customers Organizations Testers Developers Company About PortSwigger News Careers Contact Legal Privacy Notice Insights Web Security Academy Blog Research The Daily Swig PortSwigger Logo Follow us (c) 2022 PortSwigger Ltd.