Hello Ryan,
My apologies for the delay in my response.
A general overview of the effect of the Chrome and Edge updates to the Local Network Access specification on ArcGIS Online and ArcGIS enterprise can be found at this link: https://support.esri.com/en-us/knowledge-base/what-to-know-about-new-permission-prompt-in-google-chr....
This article discusses the three main implementations of the software that require CORS requests to internal servers, these being:
- iFrame Applications in ArcGIS Enterprise
- Apps like ArcGIS Enterprise Sites rely on iFrames to embed other ArcGIS Apps within the site.
- Third-Party iFrame Integrations
- Adding ArcGIS Enterprise features that reference internal content like web maps directly to other sites through iFrames.
- Applications in ArcGIS Online
- Apps like Experience Builder, used in ArcGIS Online that consume referenced services, like printing or geocoding services, from ArcGIS Server or ArcGIS Enterprise.
The key component here is the CORS requests to internal servers, which are a crucial component of the above functionalities. Unfortunately, these requests are now flagged by default by the new LNA specification, and thus bring up the prompt for end users.
For the time being, the LNA Adoption Guide provided by Google is an excellent resource to make the transition easier, and the article I linked above also includes this snippet from that guide specific to iFrames:
Add the local-network-access string to the iFrame configuration. This will ensure that the expected CORS request is sent out to the Enterprise portal for verification.
<iframe src="domainB.example" allow="local-network-access ‘DOMAIN’"></iframe>
I apologize for any inconvenience this problem has caused. Please feel free to reach back out if you have further questions, and I will do my best to address them.
Thank you,
Charles Blanchard
Associate GIS Analyst, Esri Canada
