Naidan
Guides

Explore by goal

Use Naidan

Use local AI with restricted external connections

If you want to work with a local AI server while limiting where the Naidan page can connect, open the Local-only hosted version. Its Content Security Policy (CSP) is delivered with the page and enforced by your browser.

Choose the hosted version before you start

Local-only hosted version

Open this address to use the browser-enforced connection limits below. Selecting a local endpoint inside the standard version does not switch its CSP.

https://naidan-local-only.pages.devOpen the Local-only version (external site)

Curated hosted version

Choose this when you need local servers plus the selected external services in its CSP allowlist, currently Wikipedia, Wikimedia, and Hugging Face. That list may change.

https://naidan-curated.pages.devOpen the Curated version (external site)

Standard hosted version

Choose this for the usual hosted experience, including features that need external services such as downloading models. It does not use the Local-only connection policy.

https://naidan.pages.devOpen the standard version (external site)

These versions use different site origins, so browser-stored conversations do not appear automatically when you switch between them. If you need existing conversations, export and import a ZIP: Back up and restore conversations

How each page handles connection destinationsconnect-src
Browser page
Local-only hosted versionnaidan-local-only.pages.devIts own site is also allowed
Local AI serverlocalhost / 127.0.0.1Permitted by CSP
External servicesModel download, e.g. Hugging FaceBlocked by CSP
Browser page
Curated hosted versionnaidan-curated.pages.devIts own site is also allowed
Local AI serverlocalhost / 127.0.0.1Permitted by CSP
External servicesWikipedia · Wikimedia · Hugging FacePermitted by CSP
Browser page
Standard hosted versionnaidan.pages.devNo added connect-src limit
Local AI serverlocalhost / 127.0.0.1No added connect-src limit
External servicesModel download, e.g. Hugging FaceNo added connect-src limit
The lines compare destinations a page may request, not active traffic or a guaranteed response. The local AI server is a separate process.

When publishing the Local-only and Curated versions, GitHub Actions writes each version’s CSP to a _headers file and deploys it with the site to Cloudflare Pages. Pages sends the CSP as an HTTP response header, which your browser applies. You can check the header actually received below and inspect the source here: View the deployment workflow (external site)

Connect a server running on your device

Start an AI server such as Ollama or llama.cpp server on your device, then choose its matching API provider and local URL in Naidan. The Local-only page permits connections to:

'self'
Requests to the Local-only page’s own origin: the exact site you opened, rather than the Standard or Curated sites.
http://localhost:*
An HTTP service on this device, at the port you specify.
http://127.0.0.1:*
The same device reached through its loopback IP address.

The server must be running at the URL you enter, expose the matching API, and allow this page’s origin through CORS. A URL on another machine or a LAN address is outside this CSP allowlist. Check the connection in Naidan before choosing a model. Set up a local AI server connection

What does this limit?

The page’s CSP connect-src rule limits browser requests such as API calls made with fetch or XMLHttpRequest to those destinations. Other CSP rules govern resources such as scripts and images. A direct model download from an external service such as Hugging Face is outside the Local-only connection allowlist, so features needing it may fail.

Opening the Local-only site for the first time, or fetching app files that have not been saved, requires a connection. Once the PWA’s app files are prepared in this browser, the app can open offline at the same address. A local AI server is a separate process with its own permissions and possible network activity; the page’s CSP does not control that process. Changing Naidan’s endpoint setting cannot widen the browser’s CSP allowlist.

Check the policy and the traffic in your browser

  1. Read the policy received by the page

    Open the Local-only URL. In browser developer tools, open Network and reload the page. Select the main document request, then look under Headers → Response Headers for Content-Security-Policy. Its connect-src should list the three allowed sources above.

  2. Inspect a connection you actually use

    With Network still recording, select Check Connection for your local server in Naidan. Inspect the request URL and result. This shows the destination attempted during that action; a successful response also depends on the server and browser origin rules.

  3. Read a blocked request’s reason

    If a connection fails, look in Console for a CSP violation or CORS error. A CSP message identifies a destination the page policy blocked. A failed local request may instead mean that the server is unavailable, its API URL is wrong, or its CORS settings do not allow the page.

The Network log covers requests made while it records and while you perform those actions. It helps you inspect page traffic; it does not audit a separate local server process.