One practical workaround is to rely on the user’s browser context instead of trying to reach private services from the Forge backend.
Using Custom UI, you can navigate the user’s browser to an internal endpoint:
import { router } from "@forge/bridge";
await router.navigate(internalUrl);
Because this is browser navigation, DNS resolution happens inside the user’s corporate network. This works with private DNS, internal hostnames, and even localhost, without hitting Forge CSP or backend egress restrictions.
This doesn’t change the fact that Forge cannot directly access private networks. However, if you think in terms of inbound communication, this is likely the only supported way today to integrate Forge with corporate network endpoints without exposing them publicly.
Reference: