Reports of Unexpected LNA Prompts on Public Sites During Network Fluctuations

[MayyaSunil]

Over the past three months, several firefox nightly users have reported unexpected Local Network Access prompts on sites such as Reddit, Discord, and Gmail. These incidents typically occurred during network fluctuations or when devices were waking from sleep. Users observed LNA prompts appearing on already-open tabs.

Our investigation showed that, in these cases, DNS queries for public subresources temporarily resolved to IP addresses within the local address space (at least 1 confirmed that it was their router address). Although these conditions are difficult to reproduce, we have received a handful of similar reports from different users.

We’re interested whether other implementers have encountered similar issues and plan any mitigations.

[MayyaSunil]

@christhompson @hubertchao have you encountered such scenarios during your rollout?

CC: @larseggert

[larseggert]

Specifically, the situation seems to be that some CPE devices throw up a captive portal during WAN disconnects, and that can happen during the night (some DSL modem reconnect once per day) when users are away. When that happens, some web pages (in our report, Google Docs) have some JS fire that then tries to make accesses to the captive-portalled addresses, causing the LNA prompt to be displayed. And we don't currently time that out or remove it when the captive portal disappears, so users see it when they return to their machines.

[hubertchao]

We have not heard of that specific situation, no. There are some issues that we have heard of with regards to split DNS, especially within company VPNs/managed devices where some (but not all) public traffic is routed through IP's designated as in the local address space (e.g 10.0.0.0/8 or 100.64.0.0/10), which leads to permission prompts (and broken sites) on all sorts of public web sites. (e.g. some zscalar configs https://trust.zscaler.com/private.zscaler.com/posts/26216 are causing this issue).

These reports have mostly been from enterprise organizations. We are considering adding an enterprise policy that mimics the ip-address-space-override command line flag (flag description), but I don't think the reports you're getting are enterprise customers so this probably wouldn't help?

There have also been some anecdotal reports of something similar happening with public web sites triggering LNA prompts when dealing with airline WiFi, but nothing where we've gotten any detailed netlog information.

Related, there has been a reported issue where DNS changes due to VPN cause LNA issues because of caching (https://issues.chromium.org/issues/457969523), for which we're testing the obvious solution (retry on LNA rejections from the cache).