Configuring per‑module network access in PyScript without production credentials

Answer

The network (or allow-network) attribute on a <py-script> tag is evaluated on a per‑element basis. Adding the attribute to one script element does not automatically enable network access for other <py-script> tags on the same page, unless a global configuration is in place.

Confirmed Behavior (as of PyScript 2026‑09)

• Default sandbox: All PyScript code runs with network access disabled unless explicitly granted.
• Per‑element grant: <py-script network="true"> enables network requests only for the code inside that specific tag.
• Global override: A <py-config network="true"> statement lifts the restriction for every script on the page. An individual <py-script> can still opt out by setting network="false".
• Silent failures: If the attribute is misspelled or omitted, the script will fail silently; no console warning is emitted in the current release.

Practical Verification

1. Create a minimal page with two <py-script> tags:

   <py-script network="true">
   import js
   await js.fetch('https://httpbin.org/get')
   </py-script>
   
   <py-script>
   import js
   await js.fetch('https://httpbin.org/get')
   </py-script>
   

2. Open the page in a browser that supports PyScript. The first tag should log a successful response; the second should raise a security exception (or fail silently). Check the console for any error messages.
3. Repeat with a global <py-config network="true"> and a second script set to network="false" to confirm that the override works.

Implication for Integration Testing

To test third‑party API calls without exposing production credentials, keep your test logic inside a dedicated <py-script network="true"> block and ensure all other scripts either omit the attribute or explicitly set network="false". Avoid using a global <py-config network="true"> unless you intend all scripts to have network access.

Missing Diagnostic Detail

Does your page load any external PyScript plugins or perform dynamic imports that could create additional <py-script> elements at runtime? If so, those elements might inherit a global network setting and could unintentionally bypass the per‑element restriction.