Connection Allowlists

at a glance

why it exists

Content Security Policy's connect-src directive can restrict where a page connects, but it is set by the server as a policy header and cannot easily be updated per-response or composed with dynamic endpoint lists. Connection Allowlists takes a complementary approach: the server sends a structured list of permitted URL patterns in the Connection-Allowlist response header, and the browser evaluates every outgoing connection — subresource fetches, navigations, redirects, prefetch, preload, WebSocket connections, and history.back()/history.forward() navigations — against that list before the connection is made. Connections that don't match are blocked at the network level. A report-only variant (Connection-Allowlist-Report-Only) lets developers audit their connection surface before enforcing it.

the header

Connection-Allowlist

The header value is a Structured Field list containing a single inner list. Each element is either the token response-origin (dynamically adds the response's own origin) or a quoted string matching the URLPattern syntax for absolute URLs.

Optional report-to parameter

Append ; report-to=<endpoint-name> to route violation reports to a Reporting API endpoint.

examples

Basic allowlist — same origin plus a CDN

# Server response header
Connection-Allowlist: (response-origin "https://cdn.example.com/*")

Multiple trusted endpoints

Connection-Allowlist: (response-origin "https://api.example.com/*" "https://*.assets.example.com")

Report-only mode (audit without blocking)

Connection-Allowlist-Report-Only: ("https://api.example.com/*" response-origin); report-to=security-endpoint

Express / Node.js middleware snippet

app.use((req, res, next) => {
  res.setHeader(
    'Connection-Allowlist',
    '(response-origin "https://api.example.com/*" "https://fonts.googleapis.com/*")'
  );
  next();
});

Origin trial token

<meta http-equiv="origin-trial" content="YOUR_TOKEN_HERE">

Obtain a token at developer.chrome.com/origintrials — search for "Connection Allowlists".

what the allowlist covers

At the start of the origin trial the following outgoing connections are checked against the allowlist:

• Subresource fetches (fetch(), <img>, <script>, <link>, etc.)
• Navigation requests and redirects
• Fetches from local-scheme navigations
• history.back() and history.forward() navigations
• Link prefetch and preload
• WebSocket connections

browser support

see also

• WICG Connection Allowlists — spec
• WICG/connection-allowlists — GitHub explainer
• Connection Allowlists origin trial — Chrome for Developers
• chromestatus — Connection Allowlists (5175745573945344)
• chrome-platform-showcase — live demo