Hi,
Our setup:
We have a custom Angular application (hosted by us) that embeds a Survey123 Webform inside an <iframe>. The Webform connects to our ArcGIS Enterprise Server which—when accessed inside the company network or via VPN—resolves to an internal IP address. Since the latest Chrome update (version 142.x) and the introduction of the new Local Network Access restrictions, the Webform no longer works.
What we have already tried:
Adding allow="local-network-access" and allow="local-network-access *" to the <iframe>
Sending Access-Control-Allow-Private-Network: true from our web server
Adding a CSP header such as Content-Security-Policy: frame-ancestors 'self' https://survey123.arcgis.com ...
As far as we understand, the root cause is that Chrome now blocks network requests made by a public origin inside an iframe (https://survey123.arcgis.com) to a private network resource (our internal ArcGIS Enterprise server).
At the moment, the Webform only works if we manually disable the Chrome PNA flags, but this is a temporary workaround and will eventually be removed.
Are we correct that the only long-term solution is to host the Webform (or Survey123 functionality) on our own server, or is there any other supported approach?
