Quite simple. I don't think it is a good idea to allow querying sites from the locale network if the visited site is hosted on the public internet. Let's say I

Quite simple. I don't think it is a good idea to allow querying sites from the locale network if the visited site is hosted on the public internet. Let's say I visit google.com and it resolves to google's public Webserver. Your browser should be able to see whether the IP is in the public range (if I'm not mistaken you just checking that the IP is not an A, B, or C class IP, but don't quote me on that). If it is not a local IP (e.g. localhost, LAN, WAN), the browser should disallow all request to local IP addresses (Ajax queries, HTML frames, form requests) initiated by the initial page (google or whatever). It should work the other way around of course and I have never seen a use case where a public webpage relies on being able to query or send a request to my local network if this page is from the internet. A normal HTTP redirect could be allowed because I think some routers rely on that to give the user a way to configure it (they tell the user to start configuring their router by going to config.manufacture.tld which displays some information and then issues a normal redirect to the default router IP). Post request directly sent to the local network should be strictly forbidden, though. Why would I ever want to do that?