# May 2022 - Google Chrome Private Network Access preflights **URL:** \ **Category:** News & Announcements\ **Created:** [April 14, 2022, 5:07pm UTC](https://community.forestadmin.com/t/may-2022-google-chrome-private-network-access-preflights/4492 "2022-04-14T17:07:41Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![arnaud](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/arnaud/32/32_2.png) [@arnaud](https://community.forestadmin.com/u/arnaud)\ **Post date:** [April 14, 2022, 5:07pm UTC](https://community.forestadmin.com/t/may-2022-google-chrome-private-network-access-preflights/4492/1 "2022-04-14T17:07:41Z")
Dear Forest Admin community, In light of upcoming Chrome browser updates, **Forest Admin strongly encourages you to adapt your Forest Admin agent CORS configuration** in order to keep your _development_ environments up and running without service interruption. Please note that the _remote_ and _production_ environments of your projects won’t be impacted by the change below and will continue to run without necessary intervention. # What is happening? In the near future, with the release of Google Chrome 101, the Chrome browser will progressively deploy CORS for private network and block private network resource accesses without the expected CORS preflight response header (RFC1918). > Chrome will start sending a CORS preflight request ahead of any [private network request](https://developer.chrome.com/blog/private-network-access-preflight/#what-is-private-network-access) for a subresource, which asks for explicit permission from the target server. _References:_ > **[Private Network Access: introducing preflights  |  Blog...](https://developer.chrome.com/blog/private-network-access-preflight/#rollout-plan)** > > Chrome is deprecating access to private network endpoints from non-secure public websites as part of the Private Network Access specification. Read on for recommended actions. # What consequences for Forest Admin users? It basically means that, [app.forestadmin.com](http://app.forestadmin.com/) web clients using Chrome 101 might not be able to reach _development_ environments targeting `localhost` from a web application (if the local server CORS configuration is not adapted properly). As the targeted Chrome version for the release date is not precisely defined (was supposed to be April 2022), it might appear later on an upper Chrome version. # Which projects will be impacted? This change will break data consumption in all existing _development_ environments targeting private networks, whatever the running Forest Admin agent versions. # Resolution To allow Forest Admin web clients to reach your `localhost` _development_, and thus, prevent service interruption, Forest Admin project administrators and developers will need to adapt the CORS configuration of their agent in their _development_ environments. You’ll find below the Google’s description to handle this: > **[Private Network Access: introducing preflights  |  Blog...](https://developer.chrome.com/blog/private-network-access-preflight/#server-side-requests)** > > Chrome is deprecating access to private network endpoints from non-secure public websites as part of the Private Network Access specification. Read on for recommended actions. Please find and pick below the section that corresponds to the way your project is connected to Forest Admin and follow the dedicated information: ### Admin microservice architecture Upgrade your agent dependency to the one mentioned below. You may also need to add the following middleware in order to be fully compatible with this header. In `app.js`, add this code just before `app.use(morgan("tiny"));` ```javascript app.use(function (req, res, next) { if (req.headers["access-control-request-private-network"]) { res.setHeader("access-control-allow-private-network", "true"); } next(null); }); ``` ### Express Mongoose & Express Sequelize agent running a version lower than v8 You should also be able to use the middleware provided above. Please also consider upgrading to v8 to benefit from the fixed packages, as well as new features! ### Express Mongoose agent already running on v8 `npm install forest-express-mongoose@latest` The compatible version of the agent is `>= 8.6.8` ### Express Sequelize agent already running on v8 `npm install forest-express-sequelize@latest` The compatible version of the agent is `>= 8.5.5` ### Ruby on Rails agent already running on v7 `bundle update forest_liana` The compatible version of the agent is `>= 7.6.0` ### Ruby on Rails agent already running a version lower than v7 In `config/initializers/forest_liana.rb`, add the following code: ```ruby module Rack class Cors class Resource def to_preflight_headers(env) h = to_headers(env) h['Access-Control-Allow-Private-Network'] = 'true' if env['HTTP_ACCESS_CONTROL_REQUEST_PRIVATE_NETWORK'] == 'true' if env[HTTP_ACCESS_CONTROL_REQUEST_HEADERS] h.merge!('Access-Control-Allow-Headers' => env[HTTP_ACCESS_CONTROL_REQUEST_HEADERS]) end h end end end end ``` ### Django agent `pip install --upgrade django-forestadmin` The compatible version of the agent is `>= 1.3.0` ### Laravel agent `composer update forestadmin/laravel-forestadmin` The compatible version of the agent is `>= v1.0.0-beta.18` ### Any other alternative? In a temporary situation, although Forest Admin does not recommend this approach, a possibility will be for our users to deactivate the Chrome feature flag that send Private Network Access preflights until they have completed their Forest Admin agent update. To do so: - access the Chrome flags, typing `chrome://flags/#private-network-access-send-preflights` in the URL bar - set the flag as “disabled” ![Screen Shot 2022-04-14 at 19.02.42](https://europe1.discourse-cdn.com/flex013/uploads/forest/original/2X/1/1f2cd6d2cf444c6cda36d766549657790227f857.png) A second alternative would be to use another browser that does not introduce this breaking change for _development_ environments.