Permission Policy Merger: direct-sockets-private with local-network and loopback-network

at a glance

background: Direct Sockets in Isolated Web Apps

The Direct Sockets API gives Isolated Web Apps raw TCP/UDP socket access. Previously, accessing private network addresses (LAN + loopback) required declaring a single direct-sockets-private permission policy in the IWA manifest. This all-or-nothing approach made it impossible to grant an IWA LAN access without also granting loopback access (or vice versa).

what changes

IWA manifests should be updated to declare the specific policy (or both) that their app requires. This gives developers more granular control and makes network requirements more transparent.

example

// IWA Web App Manifest (before Chrome 151)
{
  "permissions_policy": {
    "direct-sockets-private": ["self"]
  }
}

// IWA Web App Manifest (Chrome 151+ — granular control)
{
  "permissions_policy": {
    "local-network": ["self"],      // allow LAN connections
    "loopback-network": ["self"]    // allow loopback connections
  }
}

// Or just one, if the app only needs LAN access:
{
  "permissions_policy": {
    "local-network": ["self"]
  }
}

browser support

see also

• Chrome Platform Status — Permission Policy Merger: direct-sockets-private