---
description: How to configure and report on Connection Allowlist with Report URI, an egress firewall for the browser that controls which destinations your site may connect to.
---

# Connection Allowlist


## What is a Connection Allowlist?
The Connection Allowlist header lets you tell the browser exactly which destinations your site is allowed to connect to. Before any connection is opened, the browser checks the destination against your list. Anything not on the list is refused before it leaves the device.

It is an egress firewall for the browser. Where a firewall on your network controls what your servers may talk to, a Connection Allowlist controls what the code running in your visitors' browsers may talk to — including code you did not write.

Connection Allowlist ships in Chrome 152 and later, on desktop, Android and WebView. It ran as an origin trial in Chrome 148 to 151; no origin trial token is needed now. It is a Chromium feature and other browsers ignore the header.


## Getting Started
It is highly recommended that sites test a Connection Allowlist in Report Only mode before considering an enforced policy. This can be done by sending the appropriate HTTP response header:

    Connection-Allowlist-Report-Only: (response-origin "https://cdn.example.com" "https://api.example.com/v1/*"); report-to=default

Connection Allowlist uses the Reporting API to send reports, so you will need to ensure that you have it enabled:

    Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"{URL}"}],"include_subdomains":true}

You can read our documentation on [Getting Started with the Reporting API](/setup/reporting-api/#getting-started) for more information.

When you are confident the list is complete, switch to the enforcing header:

    Connection-Allowlist: (response-origin "https://cdn.example.com" "https://api.example.com/v1/*"); report-to=default

Both headers use the same syntax. The report-only header never blocks a connection, it only tells you what would have been blocked.


## Building the List
The header value is a list of permitted destinations, followed by optional parameters.

`response-origin` is a special token meaning your own origin, the one that served the page. Include it unless you genuinely want your page unable to talk to itself.

Everything else is a quoted string using [URL Pattern](https://urlpattern.spec.whatwg.org/) syntax, which is what makes this more precise than a CSP `connect-src` directive. A pattern can match a path, not just an origin:

    "https://api.example.com/v1/*"     an origin, but only under /v1/
    "https://*.example.com"            any subdomain
    "https://api.example.com:*"        any port

That path-level control is the main practical difference from CSP. `connect-src https://api.example.com` permits every path on that host, including the one an attacker chose. A Connection Allowlist can permit `/v1/*` and refuse `/collect`.


### Parameters
Two parameters change how the list is applied. Both default to `block`, so you only need to set them if you want the looser behaviour.

    Connection-Allowlist: (response-origin "https://api.example.com"); report-to=default; redirects=allow; webrtc=allow

`redirects` controls what happens when a permitted destination redirects somewhere that is not on the list. The default, `block`, refuses the redirect. Leaving this at the default matters: without it, any allowed origin can be used to reach a disallowed one.

`webrtc` controls whether WebRTC connections are allowed. The default, `block`, refuses them. WebRTC is a common data channel that other controls govern weakly, which is why it is blocked unless you opt in.


## Reading Your Reports
Reports appear on the [Connection Allowlist reports page](https://report-uri.com/account/reports/connection_allowlist/), with the page that triggered the report in the **URL** column and the refused destination in the **Connection** column.

Some connections have no hostname to report. WebRTC is the common case, and it appears in the Connection column as the literal value `webrtc` rather than a URL. That is the browser telling you a WebRTC connection was refused, not a malformed report.


## Filtering Reports
Connection Allowlist reports are sampled at **10%** by default, so one report in ten is stored. This is a new browser feature and a page with a busy or incomplete list can produce a very large number of reports, so the default protects your quota while still showing you the shape of the problem.

You can change the rate, in either direction, on the [Filters](https://report-uri.com/account/filters/) page. See [Sampling](/setup/sampling/) for how the rate affects what you store and what you are charged.


## Useful Links
Connection Allowlist is a very new browser technology, having shipped in Chrome 152 in August 2026:

https://scotthelme.co.uk/connection-allowlist-a-network-firewall-built-into-the-browser/

https://developer.chrome.com/blog/connection-allowlists-origin-trial

https://wicg.github.io/connection-allowlists/

https://urlpattern.spec.whatwg.org/

## Start Monitoring with Report URI

**Already using us?** Find your Reporting API endpoint on [Setup](https://report-uri.com/account/setup/), or view your [Connection Allowlist reports](https://report-uri.com/account/reports/connection_allowlist/).

**New to Report URI?** Create an account, then grab your Reporting API endpoint from the [Setup](https://report-uri.com/account/setup/) page to use in the header above.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)