1919889 - Cannot access local network sites in macOS Sequoia

Status: RESOLVED FIXED

(Core :: Widget: Cocoa, defect, P3)

Description

[Denis W]

Attachment: Screen Shot 2024-09-19 at 3.36.14 PM.png

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0

Steps to reproduce:

Starting from macOS Sequoia, applications that access sites in the local network are expected to request Local Network permission similar to how it's done in iOS.

For Safari, it's implicitly granted. Chrome and -ium browsers will ask for this permission on first launch (see screenshot). Firefox does not ask, and there's no way to manually add an app in the Local Network page in System Settings.

Actual results:

Accessing local sites (i.e. 192.168.x.x) fails in Firefox.

Expected results:

I should have access to intranet sites, and see the permissions dialog to grant local network access to Firefox.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Vivien M. (he/him)]

This affects Firefox 130.0.1 as well.

Comment 3

[Stephen A Pohl [:spohl]]

Setting an initial severity of S2 and I'm looking into it.

Comment 4

[Stephen A Pohl [:spohl]]

I'm currently unable to reproduce this on macOS 15.0 (24A335) and any version of Firefox. For example, I'm able to access a site at 192.168.8.1 without any problems. Could you tell us what your Firewall settings are? Is Firefox listed in the list of apps allowed/blocked from accepting incoming connections? Do you have the option "Automatically allow downloaded signed software to receive incoming connections" turned on?

Comment 5

[Stephen A Pohl [:spohl]]

Attachment: Prompt in Firefox Nightly

Actually, I was just able to reproduce this with Firefox Nightly. However, the first time that I am trying to access a local site I am prompted in the same way as you've experienced with Chrome (see attachment). Could you go to Privacy and Security Settings -> Local Network in System Settings and double-check that Firefox isn't blocked from accessing the local network?

Comment 6

[Vivien M. (he/him)]

I have the same issue, and there's no sign of Firefox one way or the other in Privacy and Security -> Local Network.

Comment 7

[Stephen A Pohl [:spohl]]

(In reply to Vivien M. (he/him) from comment #6)

I have the same issue, and there's no sign of Firefox one way or the other in Privacy and Security -> Local Network.

Could you tell us the path where you have Firefox installed?

Comment 8

[Vivien M. (he/him)]

(In reply to Stephen A Pohl [:spohl] from comment #7)

(In reply to Vivien M. (he/him) from comment #6)

I have the same issue, and there's no sign of Firefox one way or the other in Privacy and Security -> Local Network.

Could you tell us the path where you have Firefox installed?

A very boring Macintosh HD/Applications ? I just copied Firefox from the DMG into the normal Applications folder long ago and it has updated itself since.

Comment 9

[Vivien M. (he/him)]

Interesting (and unhelpful). On a different Mac, this one Intel and with the Sophos firewallish thing enabled, Firefox does show up in Privacy and Security -> Local Network... and it works fine.

Comment 10

[Stephen A Pohl [:spohl]]

What version of macOS are you running? If you go to "About This Mac" in the Apple menu and click on the macOS version, what is displayed in parenthesis? And what type of local URL or IP address are you trying to access?

Comment 11

[Vivien M. (he/him)]

24A335 on both machines, both the one that works and the one that doesn't.

Trying to access internal web servers using FQDNs that resolve to 192.168.22.* addresses (192.168.22.* is my home network).

Comment 12

[Stephen A Pohl [:spohl]]

Can you confirm that this problem only occurs if you use FQDNs? Or does this also reproduce if you try to access the sites via IP address directly?

Comment 13

[Vivien M. (he/him)]

Just tried with an IP; same behaviour.

I haven't had a ton of time to play with this, but I do find it odd that this didn't happen on my two Intel Macs. But my two Intel Macs have Sophos web protection enabled, maybe that somehow plays into it somehow...

Comment 14

[Denis W]

(In reply to Stephen A Pohl [:spohl] from comment #4)

I'm currently unable to reproduce this on macOS 15.0 (24A335) and any version of Firefox. For example, I'm able to access a site at 192.168.8.1 without any problems. Could you tell us what your Firewall settings are? Is Firefox listed in the list of apps allowed/blocked from accepting incoming connections? Do you have the option "Automatically allow downloaded signed software to receive incoming connections" turned on?

I wanted to try a fresh copy of Firefox Nightly to reproduce this, but it keeps hanging with 100% CPU use on start. Anyways...

I tried my ISP hub's page at 192.168.1.5 and that worked, although it's probably because it's the gateway IP. What isn't working is my server that is statically assigned to 192.168.1.120.

Firewall settings:

• "block all incoming connections" is OFF
• there is an entry for org.mozilla.firefoxdeveloperedition that is set to "Allow incoming connections", and is not editable
• "Automatically allow built-in software to receive incoming connections" and "Automatically allow downloaded signed software to receive incoming connections" are both ON, "enable stealth mode" is OFF

Comment 15

[Renaud Allard]

In fact, you are able to open the URL (by IP or FQDN) for your default gateway, but nothing else in the inside LAN, wether you are using IP of FQDN doesn't change anything.
So, if your gateway is 192.168.1.1, you can open https://192.168.1.1, but opening https://192.168.1.10 will show an "unable to connect".

Comment 16

[Renaud Allard]

With 130.0.1, firefox was in "Privacy & Security" -> "local network", but disabled. After enabling the permission, firefox worked as intended.
I got no popup asking me to allow local network access.

Comment 17

[Denis W]

Okay now this is weird. In dev edition, I tried hitting 192.168.1.1 which isn't assigned to anything on my network. Now I'm getting the local network prompt. Everything's good after that.

Comment 18

[Stefan Weil]

I had this issue, too (reported here) with Firefox and Chrome. It was fixed by enabling "Privacy & Security" -> "local network" (in German "Datenschutz und Sicherheit" -> "Lokales Netzwerk") for both browsers.

Previously macOS had asked whether I would like to give these (and some more) applications additional permissions, but the question was about "communication with local devices" ("Kommunikation mit lokalen Geräte"), and I did not think that communication with a local device might be related to accessing a local web service.

Comment 19

[Vivien M. (he/him)]

(In reply to Stefan Weil from comment #18)

I had this issue, too (reported here) with Firefox and Chrome. It was fixed by enabling "Privacy & Security" -> "local network" (in German "Datenschutz und Sicherheit" -> "Lokales Netzwerk") for both browsers.

Previously macOS had asked whether I would like to give these (and some more) applications additional permissions, but the question was about "communication with local devices" ("Kommunikation mit lokalen Geräte"), and I did not think that communication with a local device might be related to accessing a local web service.

The problem some of us are having, though, is that that original prompt never shows up and Firefox never registers itself in that macOS mechanism.

It's very strange though - I have... 3... Macs with Sonoma, and only one of the three is displaying this behaviour. The other two, the first time going to a local site, triggered that dialog, I approved it, Firefox shows up in that privacy & security settings, all good. Chrome behaves consistently across all three machines, I think.

Comment 20

[Vivien M. (he/him)]

Oops, I don't think there's a way to edit, I meant Sequoia, not Sonoma... too many S names ending in a...

Comment 21

[Steven Tierney]

I upgraded to Sequoia 15.0.0 on my M2 Macbook Air with the firewall switched on.
After the upgrade Firefox could access only sites on the Internet, but not machines on the local network, both using host name and IP Address, in Private Window and in normal window.
In Settings > Network > Firewall there was an entry for Firefox that could not be toggled to allow or to block.
There was no sign of Firefox in Settings > Privacy & Security > Local Network, nor did Firefox prompt to have this added.
Chrome & Safari worked OK, with Chrome prompting to be added to Local Network on attempting to browse there.

I used the command in Comment 21 of Bug 1919173 to add Firefox to the firewall. That provided a second entry here, but one that could be toggled to allow or to block. Then on browsing a local site Firefox then prompted to be added to Local Network, but when accepted still was blocked from accessing sites here. Checking in Local Network showed Firefox here, toggled on.

I switched off the firewall. No change, Firefox still could not browse to sites on the local network.

I installed the update to Sequoia 15.0.1 when offered, hoping for a fix.
No change. Firefox still could not browse to sites on the local network. Also no visible changes to the configurations on the firewall or local network.

What fixed it for me was this sequence of events:
With the firewall switched on:

• The new entry added above was removed from the Firewall using the '-' button.
• Firefox was uninstalled by navigating to Applications, then Right Mouse Button on the Firefox.app > Move To Bin, then empty the bin.
• The Mac was restarted.
  At this point there were no entries for Firefox both in Firewall and in Local Network.

With the Firewall switched off:

• Firefox was installed.
• A check that Firefox could browse to local network and internet showed that both were now possible.
• The firewall was switched on. Here there was one entry for Firefox that could be toggled to allow or to block, which was set to allow.
• On browsing to a site on the local network Firefox prompted, and on accepting was added to Local Network.

It has been fine ever since.

Comment 22

[Markus Stange [:mstange]]

Kershaw, do you know if there's a way to detect in Firefox that a network request was blocked due to the Firewall, so that we can show a more actionable warning on the error page?

Though, given the previous comments, it might be hard to know what to write in the error page. If you really need to uninstall + reinstall Firefox to make the setting work properly, that's not the greatest advice to give.

Comment 23

[Kershaw Chang [:kershaw]]

(In reply to Markus Stange [:mstange] from comment #22)

Kershaw, do you know if there's a way to detect in Firefox that a network request was blocked due to the Firewall, so that we can show a more actionable warning on the error page?

Unfortunately, no. I believe the error code we received from the NSPR layer is either NS_ERROR_NET_RESET or NS_ERROR_CONNECTION_REFUSED. Neither of these codes can be used to detect if the issue is due to a firewall.

Comment 24

[Steven Tierney]

For information I received the message: NS_ERROR_CONNECTION_REFUSED.

Comment 25

[Valentin Gosu [:valentin] {{ PTO 3 July - 3 August }}]

Bug 1926661 confirmed that the problem seems to be with Mac OS Sequoia introducing a new Local Network permission:
https://support.apple.com/guide/mac-help/control-access-to-your-local-network-on-mac-mchla4f49138/mac

I'm considering changing the error page on OSX to tell users to check the Local network permission.
As far as I can tell there's no way to check it from the application's code (is there?).

Note that it's very easy to deny this prompt and later fail to realize why local network connections are failing.

Comment 26

[Haik Aftandilian [:haik]]

There is some more documentation here https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy

I don't know if there is a good way to detect if we have access or not, but we should be able to display a button or link that opens the relevant page in the privacy settings for the user to check.

Comment 27

[Vivien M. (he/him)]

The problem I am having is a little different - for some unknown reason, on one machine, I never get the prompt and Firefox is never registered so you can't see it in the privacy settings later.

Comment 28

[Haik Aftandilian [:haik]]

(In reply to Vivien M. (he/him) from comment #27)

The problem I am having is a little different - for some unknown reason, on one machine, I never get the prompt and Firefox is never registered so you can't see it in the privacy settings later.

@Vivien, have you upgraded to macOS 15.1 yet? Apple's site about local network privacy states "macOS 15.1 fixed a number of local network privacy bugs. If you encounter local network privacy problems on macOS 15.0, retest on macOS 15.1 or later."

Prior to 15.1, other users have reported that deleting Firefox and then reinstalling it resulted in it appearing in the "Local Network" privacy settings screen after attempting to access the local network again.

Comment 29

[Vivien M. (he/him)]

Hmm... maybe I hadn't tried again in 15.1, I just tried now in a private window and it gave me the prompt and let me approve the local network access.

Comment 31

[bugmonkey]

I am on Sequoia 15.1 and am still having issues with this. I enable Firefox under Settings -> Privacy & Security -> Local Network and it works for a while but randomly stops working until I toggle that setting.

Comment 32

[Gian-Carlo Pascutto [:gcp]]

Stephen, is this still S2 given the fixes in macOS 15.1?

Comment 33

[Stephen A Pohl [:spohl]]

I'm going to mark this as resolved > fixed for now. Comment 31 is concerning, but given Apple's fixes so far it is likely that any followup fixes for any similar issues will need to come from Apple as well.