Files
OmniRoute/tests/unit
diegosouzapw cfd1007f0d fix(docker): require a per-session token on the VNC browser CDP bridge (#12571)
docker/vnc-browser/chromium/cdp-bridge.py republished Chromium's loopback
CDP port (127.0.0.1:9222) onto 0.0.0.0:9223 with zero auth, and the
container joined Docker's default bridge network — any sibling container
could connect to 9223 and issue arbitrary CDP commands (Runtime.evaluate,
cookie theft) against a live, credential-bearing browser-login session.

- cdp-bridge.py now requires a shared secret (CDP_BRIDGE_TOKEN) presented
  as an X-Omni-Cdp-Token header on the first bytes of a connection before
  forwarding anything upstream; a missing/invalid token gets the socket
  closed silently.
- src/lib/vncSession/service.ts generates a random per-session token,
  injects it into the container via -e CDP_BRIDGE_TOKEN, and joins the
  container to a dedicated Docker network (not the default bridge) as
  defense-in-depth.
- src/lib/vncSession/harvest.ts forwards the token on every CDP HTTP/WS
  call so the harvester keeps working end-to-end.
2026-09-10 13:53:01 -03:00
..
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00
2026-08-26 14:25:01 -03:00