Chrome 147+ on macOS: "Error code 5" after Referrer-Policy / X-Content-Type-Options headers added in 0.23.2

[arghaffari]

Bug description

Starting with marimo 0.23.2, Chrome 147+ on macOS (Sequoia 26.4) shows "Can't open this page — Error code: 5" when navigating to http://127.0.0.1:2718 or http://localhost:2718 in edit mode. The server starts fine, curl returns HTTP 200 with valid HTML, but Chrome refuses to render the page.

marimo 0.23.1 and earlier work correctly with the same Chrome version and macOS configuration.

Root cause

PR #9170 (commit 727dc67) introduced two new response headers on HTML page responses:

_HTML_SECURITY_HEADERS: dict[str, str] = {
    "Referrer-Policy": "no-referrer",
    "X-Content-Type-Options": "nosniff",
}

These headers are added in marimo/_server/api/endpoints/assets.py (line 130–133).

Chrome 147 on macOS enforces Local Network Access permissions (introduced in Chrome 130+). When combined with Referrer-Policy: no-referrer, Chrome appears to treat the localhost page load as a private-network request without a valid referrer, triggering the Local Network Access check. If the macOS "Local Network" permission for Chrome has any edge-case state (toggled but not restarted, or enterprise-managed), Chrome blocks the page entirely with error code 5.

Evidence from bisection:

Version	Referrer-Policy header	X-Content-Type-Options header	Chrome 147 loads?
0.20.4	absent	absent	✅ Yes
0.21.0	absent	absent	✅ Yes
0.22.0	absent	absent	✅ Yes
0.23.1	absent	absent	✅ Yes
0.23.2	no-referrer	nosniff	❌ Error code 5
0.23.3	no-referrer	nosniff	❌ Error code 5
0.23.5	no-referrer	nosniff	❌ Error code 5

Environment

• marimo: 0.23.2+ (broken), 0.23.1 (works)
• Chrome: 147.0.7727.138
• macOS: Sequoia 26.4.0 (darwin 25.4.0), Apple Silicon (arm64)
• Python: 3.13.5
• Launch command: marimo edit notebook.py --port 2718 --host 127.0.0.1 --no-token

Steps to reproduce

1. Install marimo 0.23.2+: pip install marimo==0.23.5
2. Start edit mode: marimo edit notebook.py --host 127.0.0.1 --no-token
3. Open http://127.0.0.1:2718 in Chrome 147+ on macOS
4. Observe "Can't open this page — Error code: 5"
5. Downgrade to 0.23.1: pip install marimo==0.23.1 and repeat — page loads fine

Workarounds

• Downgrade to marimo 0.23.1
• Use Safari instead of Chrome (Safari is not affected)
• Use --host 0.0.0.0 instead of 127.0.0.1 (sometimes works)

Suggested fix

Consider making the Referrer-Policy header conditional — either:

1. Only set it when --token-auth is active (the header's purpose is to prevent token leakage via Referer, which is moot with --no-token)
2. Use Referrer-Policy: same-origin instead of no-referrer (still prevents cross-origin leakage but doesn't strip the referrer entirely for same-origin requests)
3. Add Access-Control-Allow-Private-Network: true to the response headers to explicitly satisfy Chrome's Private Network Access check

Option 2 seems like the best balance of security and compatibility.

[mscolnick]

Thanks for raising this. I can't repro this myself. I can add Referrer-Policy: same-origin, but I'm not sure if that will actually fix the issue. Have you tried filliping this value yourself? either running locally or editing the downloaded python files?

The "sometimes works" for --host 0.0.0.0 makes this more suspicious. Is it non-deterministic?

[mscolnick]

If you can share your HAR file from the network console when this fails. I might be able to diagnose a bit more.