Chrome Private Network Access (PNA) Blocking SPFx Localhost Development

[bdking71]

With the recent Chrome PNA changes (Chrome 141+), SharePoint Framework (SPFx) developers are unable to access local network services when developing against the SharePoint Hosted Workbench. Specifically:

• When loading manifest.js or other assets from https://localhost, Chrome treats localhost as a “Public” site.
• Any requests from the workbench to local or intranet services are blocked by the new Private Network Access restrictions.

Workarounds:

• Manually allow local network access per site:
  ** Navigate to chrome://settings/content/siteDetails?site=https://localhost
  ** Set Local Network Access to Allow
  Repeat the above step for each internal web service or endpoint.

Impact:

• This breaks SPFx local development for solutions that rely on internal APIs or services.
• Workarounds are tedious and not scalable for dev teams.
• SPFx debugging is effectively blocked in Chrome unless every internal endpoint is manually whitelisted.

Request:

• Guidance from the SPFx team on officially supporting local development under the new Chrome PNA model.

Notes:

The issue does not occur in Edge or Firefox, which still allow localhost to access internal network resources by default.
Current Chrome “Allow” setting only works per origin, so local network APIs remain blocked until explicitly allowed.

[Ashlesha-MSFT]

Hello @bdking71 ,
Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.
If you don’t receive a reply within two working days, please use this escalation form to escalate.

[Ashlesha-MSFT]

This behavior is expected due to Chrome’s Private Network Access enforcement. While this is not a defect in SPFx, we recognize the impact on local development workflows.

Recommended options:

• Use Edge or Firefox for local SPFx development in the short term
• Use the SharePoint Online workbench where applicable
• Update internal APIs to explicitly allow private network access
• Consider a reverse-proxy or same-origin setup for long-term stability