Link previews

A link card can show a picture: a screenshot of the page, when you sent it from the tab, or else the preview image the site names for link cards (og:image and the like). Getting that image means midden fetching from the open web on its own, which is the one thing midden does that you didn't directly ask for. This page describes what it fetches, what it refuses to reach, and what that doesn't cover.

When it fetches

• Only for a new link, once. A link gets one picture. The one exception is a screenshot, which a sharper screenshot of the same link replaces.
• Only with the setting on and the browser's permission given. The setting (in the header menu) is on by default, but the extension can't fetch from sites until you allow it, which is Chrome's own prompt for the optional host permission. Until then a one-time notice offers the click. Off, or never allowed: no fetching at all, and screenshots aren't kept either.
• A screenshot never fetches anything. It's the tab you were looking at.
• Never for a link that carries a secret: a token, a signature, a password, or a one-time sign-in or reset path (the same link rules Bring in's secrets check uses). Fetching such a link can use it up or sign you in somewhere.

What a fetch is

Two requests at most: the page, for its <head>, then the image it names.

• No cookies, no referrer (credentials: 'omit', referrerPolicy: 'no-referrer'). The site sees a request from your network address, not who you are on it.
• Capped: 10 seconds, the first 1 MB of the page (the head is near its start), images up to 8 MB. SVG is refused. The picture is redrawn as WebP, at most 1280 px wide.
• Best effort: anything unexpected and the card goes without a picture.

What it won't reach

A public page can redirect, or name a preview image somewhere else. midden refuses anything that isn't http(s) to a public host:

• single-label names (localhost, intranet names) and names ending in a dot;
• names under .local, .localhost, .internal, .lan, .home, .arpa;
• IPv4 private, loopback, link-local, shared (100.64/10), multicast and reserved ranges, and 0.x;
• IPv6 loopback, unique-local, link-local and IPv4-mapped addresses. In the extension the browser rules (below) go further and refuse every IPv6 literal.

How (the extension)

Two layers, either of which stops it:

1. The address is checked before fetching, and again after: the page's URL, the image's URL, and where a redirect ended up. A response that landed off the public web is thrown away unread.
2. Browser rules block the request at every hop, redirects included, before it connects. fetch() follows redirects without showing the hops, so the check in (1) only sees the end of the chain. These are declarativeNetRequest session rules, limited to midden's own requests: one per kind of address above, and the named suffixes as requestDomains.

Previews fail closed. They run only once every guard rule is confirmed in place. If the browser refuses the rules, or they can't be read back, previews stay off and the console says why ([midden] preview guard failed; link previews stay off). The pages check before fetching; the service worker checks before handing a job to the offscreen document, which can't see the rules itself.

Chrome compiles each rule's pattern with RE2 under a 2 KB memory cap and rejects the whole set if any one is over. The patterns are kept to one kind of address each, measured at about 1.4–1.6 KB, and a test fails if one grows much longer.

How (the phone)

The app follows no redirects on its own (disableRedirects): each hop's address is checked before it's requested, so nothing private is ever contacted.

What this doesn't cover

• A public name that resolves to a private address (DNS rebinding). The browser resolves names after its rules match, and an extension can't see the answer, so a name on the public web that points at your network gets through both layers.
• The site knows it was fetched: from your network address, at about the time you saved the link. Turn previews off if that matters for what you save.
• What the picture shows is whatever the site chose. midden doesn't check it.