# Files changed · PR \#22835 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/22835/diffs)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

[fix\(desktop\): browser tabs no longer report loopback access as denied](https://git.cafe/pingdotgg/t3code/pull/22835.md)

Version: 4

Head commit: 5f19a01a81fe8d347286d7f75c893400591bfb77

Base commit: 066c8fc0cd04c97988ff8892e440189545ac6994

Comparison base: 066c8fc0cd04c97988ff8892e440189545ac6994

Showing up to 20 entries from this revision. If the pull request changes, reopen the first page before continuing.

## apps/desktop/src/preview/BrowserSession.test.ts

Status: modified; +10; −2

```diff
@@ -180,6 +180,7 @@
         "clipboard-sanitized-write",
         "geolocation",
         "fullscreen",
+        "loopback-network",
       ]) {
         assert.isTrue(requestAllows(permission), `request handler should allow ${permission}`);
         assert.isTrue(
@@ -190,8 +191,15 @@
 
       // `clipboard-write` is not a real Electron permission — the async write API
       // uses `clipboard-sanitized-write` — so the stale name must not be granted,
-      // and unrelated permissions stay denied.
-      for (const permission of ["clipboard-write", "notifications", "midi"]) {
+      // and unrelated permissions stay denied. Loopback access does not extend to
+      // the rest of the local network, under either its current or legacy name.
+      for (const permission of [
+        "clipboard-write",
+        "notifications",
+        "midi",
+        "local-network",
+        "local-network-access",
+      ]) {
         assert.isFalse(requestAllows(permission), `request handler should deny ${permission}`);
         assert.isFalse(
           checkHandler(null, permission) as boolean,
```

## apps/desktop/src/preview/BrowserSession.ts

Status: modified; +5; −0

```diff
@@ -38,6 +38,11 @@
   // and every preview guest, so a page that goes fullscreen fills its own
   // webview instead of taking over the whole T3 window.
   "fullscreen",
+  // Electron 44 does not gate loopback requests behind this permission, so pages
+  // can already reach 127.0.0.1. Denying the check only makes
+  // `navigator.permissions.query` lie, and sign-in widgets that read it first,
+  // such as Okta FastPass reaching Okta Verify, give up before trying (#9724).
+  "loopback-network",
   // Deliberately NOT local-fonts: preview sessions run untrusted web content,
   // and silently granting it would hand every page the user's installed-font
   // fingerprint (and font file bytes via FontData.blob()).
```