title: Private Network Access problem w/ disabled web security: Request had no target IP address space, yet the resource is in address space local
body: <p>We have a test environment on a public site. There we use --disable-web-security flag on chrome for the testers to bypass CORS errors for public service calls during manual test phase. And also we have localhost requests on the agent machine. However today with Chrome 98 update we started struggling with the network requests targeting localhost.</p>
  <p>The error we get is for the localhost requests from a public site: <br>
  <code>Access to XMLHttpRequest at 'https://localhost:3030/static/first.qjson' from origin 'https://....com' has been blocked by CORS policy: Request had no target IP address space, yet the resource is in address space `local`.</code></p>
  <p>The site on localhost is configured to return Access-Control-Allow-* CORS headers including &quot;Access-Control-Allow-Private-Network: true&quot;.</p>
  <p>And also I do not see any preflight request. Just one GET request with CORS error on it.</p>
  <p>We suspect this might be a side effect caused when you disable web security by --disable-web-security. It might be preventing obtaining of the target IP address space. Our assumption is based on the CORS preflight section on <a href="https://wicg.github.io/private-network-access/" rel="noreferrer">https://wicg.github.io/private-network-access/</a></p>
  <blockquote>
  <p>3.1.2. CORS preflight<br>
  The HTTP fetch algorithm should be adjusted to ensure that a preflight is triggered for all private network requests initiated from secure contexts.<br><br>
  The main issue here is again that the response’s IP address space is not known until a connection is obtained in HTTP-network fetch, which is layered under CORS-preflight fetch.</p>
  </blockquote>
  <p>So does anyone know any workaround for Private Network Access with --disable-web-security flag ?
  Or maybe we are missing something. Thanks for the help.</p>