Skip to content

Fix workflow builder Private Network Access for Chrome 142+ #1794

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
alexnorell merged 3 commits into from
Dec 10, 2025
Merged

Fix workflow builder Private Network Access for Chrome 142+ #1794

alexnorell merged 3 commits into from
Dec 10, 2025

Conversation

@alexnorell
Copy link
Contributor

@alexnorell alexnorell commented Dec 10, 2025 •
edited
Loading

Summary

Fixes the workflow builder to work with Chrome 142+ which enforces Private Network Access (PNA) security.

Changes:

  • Add local-network-access permission to builder iframe (required by Chrome 142+)
  • Add PNA preflight handling in PathAwareCORSMiddleware to return Access-Control-Allow-Private-Network: true
  • Expand CORS path regex to include /workflows/ endpoints used by the builder UI

Test plan

  • Build docker image with ENABLE_BUILDER=true
  • Open http://localhost:9003/build in Chrome incognito
  • Verify API calls to /build/api and /workflows/ endpoints succeed
  • Verify workflow builder UI loads and functions correctly

@alexnorell alexnorell requested a review from hansent as a code owner December 10, 2025 02:11
@alexnorell alexnorell force-pushed the fix/builder-cors-origins branch from 6a78059 to 45d8ba3 Compare December 10, 2025 02:49
@alexnorell alexnorell changed the title Add BUILDER_CORS_ORIGINS for multiple allowed origins Fix workflow builder CORS and Private Network Access for Chrome 142+ Dec 10, 2025
yeldarby
yeldarby previously approved these changes Dec 10, 2025
View reviewed changes
@alexnorell
Fix workflow builder CORS and Private Network Access for Chrome 142+
358d2c2 
- Add local-network-access permission to builder iframe
- Add PNA preflight handling in PathAwareCORSMiddleware
- Expand CORS path regex to include /workflows/ endpoints
@alexnorell alexnorell force-pushed the fix/builder-cors-origins branch from 45d8ba3 to 358d2c2 Compare December 10, 2025 02:56
@alexnorell alexnorell requested a review from yeldarby December 10, 2025 02:56
@alexnorell alexnorell changed the title Fix workflow builder CORS and Private Network Access for Chrome 142+ Fix workflow builder Private Network Access for Chrome 142+ Dec 10, 2025
@alexnorell alexnorell merged commit 9c229d0 into main Dec 10, 2025
51 checks passed
@alexnorell alexnorell deleted the fix/builder-cors-origins branch December 10, 2025 18:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@grzegorz-roboflow grzegorz-roboflow grzegorz-roboflow approved these changes

@PawelPeczek-Roboflow PawelPeczek-Roboflow Awaiting requested review from PawelPeczek-Roboflow PawelPeczek-Roboflow is a code owner

@probicheaux probicheaux Awaiting requested review from probicheaux probicheaux is a code owner

@hansent hansent Awaiting requested review from hansent hansent is a code owner

@yeldarby yeldarby Awaiting requested review from yeldarby yeldarby is a code owner

Assignees

@yeldarby yeldarby

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@alexnorell @yeldarby @grzegorz-roboflow