@buoy-gg/core 7.0.26 → 7.0.28

package/bin/buoy.js

@@ -159,6 +159,12 @@ function awaitKeyFromBrowser() {
         res.setHeader('Access-Control-Allow-Origin', SITE);
         res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
         res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+        // Private Network Access: Chrome is moving to require a public site to
+        // be granted permission before it may reach loopback, via this header
+        // on the preflight. Sending it costs nothing today and is the
+        // difference between this flow surviving that rollout and silently
+        // failing for every Chrome user on the same day.
+        res.setHeader('Access-Control-Allow-Private-Network', 'true');
       }
 
       if (req.method === 'OPTIONS') {