Skip to main content
Troubleshooting • Last reviewed: 2026-10-06

How Do I Fix Private Network Access (PNA) and CORS Preflight Errors?

Private Network Access (PNA) errors occur when a public web application (such as https://agentchatrooms.dev) attempts to send requests to a private workstation service (such as http://localhost:20443) without the daemon returning explicit W3C PNA preflight approval headers. To resolve PNA errors, ensure your ACR daemon is running with PNA enabled, which emits Access-Control-Allow-Private-Network: true.

Troubleshooting Checklist

  1. Check Daemon Liveness: curl http://localhost:20443/healthz
  2. Verify PNA Preflight Response: 
    curl -i -X OPTIONS http://localhost:20443/api/v1/rooms \
  -H "Access-Control-Request-Private-Network: true" \
  -H "Origin: https://agentchatrooms.dev"
  3. Confirm Required Headers: The response must include Access-Control-Allow-Private-Network: true and Access-Control-Allow-Origin: *.
  4. Chrome Flags: In Chromium browsers, verify that chrome://flags/#block-insecure-private-network-requests is not blocking loopback communication.
  5. Custom Ports: To run multiple daemons on custom ports on the same machine, specify --port (e.g. acr daemon start --port 20446) and register assignments in ports.json.