Connection Allowlist¶
What is a Connection Allowlist?¶
The Connection Allowlist header lets you tell the browser exactly which destinations your site is allowed to connect to. Before any connection is opened, the browser checks the destination against your list. Anything not on the list is refused before it leaves the device.
It is an egress firewall for the browser. Where a firewall on your network controls what your servers may talk to, a Connection Allowlist controls what the code running in your visitors' browsers may talk to — including code you did not write.
Connection Allowlist ships in Chrome 152 and later, on desktop, Android and WebView. It ran as an origin trial in Chrome 148 to 151; no origin trial token is needed now. It is a Chromium feature and other browsers ignore the header.
Getting Started¶
It is highly recommended that sites test a Connection Allowlist in Report Only mode before considering an enforced policy. This can be done by sending the appropriate HTTP response header:
Connection-Allowlist-Report-Only: (response-origin "https://cdn.example.com" "https://api.example.com/v1/*"); report-to=default
Connection Allowlist uses the Reporting API to send reports, so you will need to ensure that you have it enabled:
Report-To: {"group":"default","max_age":31536000,"endpoints":[{"url":"{URL}"}],"include_subdomains":true}
You can read our documentation on Getting Started with the Reporting API for more information.
When you are confident the list is complete, switch to the enforcing header:
Connection-Allowlist: (response-origin "https://cdn.example.com" "https://api.example.com/v1/*"); report-to=default
Both headers use the same syntax. The report-only header never blocks a connection, it only tells you what would have been blocked.
Building the List¶
The header value is a list of permitted destinations, followed by optional parameters.
response-origin is a special token meaning your own origin, the one that served the page. Include it unless you genuinely want your page unable to talk to itself.
Everything else is a quoted string using URL Pattern syntax, which is what makes this more precise than a CSP connect-src directive. A pattern can match a path, not just an origin:
"https://api.example.com/v1/*" an origin, but only under /v1/
"https://*.example.com" any subdomain
"https://api.example.com:*" any port
That path-level control is the main practical difference from CSP. connect-src https://api.example.com permits every path on that host, including the one an attacker chose. A Connection Allowlist can permit /v1/* and refuse /collect.
Parameters¶
Two parameters change how the list is applied. Both default to block, so you only need to set them if you want the looser behaviour.
Connection-Allowlist: (response-origin "https://api.example.com"); report-to=default; redirects=allow; webrtc=allow
redirects controls what happens when a permitted destination redirects somewhere that is not on the list. The default, block, refuses the redirect. Leaving this at the default matters: without it, any allowed origin can be used to reach a disallowed one.
webrtc controls whether WebRTC connections are allowed. The default, block, refuses them. WebRTC is a common data channel that other controls govern weakly, which is why it is blocked unless you opt in.
Reading Your Reports¶
Reports appear on the Connection Allowlist reports page, with the page that triggered the report in the URL column and the refused destination in the Connection column.
Some connections have no hostname to report. WebRTC is the common case, and it appears in the Connection column as the literal value webrtc rather than a URL. That is the browser telling you a WebRTC connection was refused, not a malformed report.
Filtering Reports¶
Connection Allowlist reports are sampled at 10% by default, so one report in ten is stored. This is a new browser feature and a page with a busy or incomplete list can produce a very large number of reports, so the default protects your quota while still showing you the shape of the problem.
You can change the rate, in either direction, on the Filters page. See Sampling for how the rate affects what you store and what you are charged.
Useful Links¶
Connection Allowlist is a very new browser technology, having shipped in Chrome 152 in August 2026:
https://scotthelme.co.uk/connection-allowlist-a-network-firewall-built-into-the-browser/
https://developer.chrome.com/blog/connection-allowlists-origin-trial
https://wicg.github.io/connection-allowlists/
https://urlpattern.spec.whatwg.org/
Start Monitoring with Report URI¶
Already using us? Find your Reporting API endpoint on Setup, or view your Connection Allowlist reports.
New to Report URI? Create an account, then grab your Reporting API endpoint from the Setup page to use in the header above.