Skip to content

Fix session isolation for remote browser WebSocket connections - #305

Merged
abrom merged 2 commits into
Studiosity:mainfrom
wooly:wooly/fix-remote-chrome-context-leakage
Apr 2, 2026
Merged

abrom merged 2 commits into
Studiosity:mainfrom
wooly:wooly/fix-remote-chrome-context-leakage

Conversation

@wooly

@wooly wooly commented Mar 26, 2026

Copy link
Copy Markdown
Contributor

When using browser_ws_endpoint to connect to a remote Chrome instance, pages are created via browser.newPage() in the default browser context. Cookies (and other browsing state) set during one request persist in the default context and leak into subsequent requests from other users.

This PR updates the behaviour to use browser.createBrowserContext() instead. This behaves like an incognito session — state is fully isolated and automatically cleared when context.close() is called after the request completes.

Added a test that:

  1. Launches a persistent Chrome instance (simulating a remotely running Chrome) and retrieves its WS endpoint
  2. Makes a first request that sets a cookie via evaluateOnNewDocument
  3. Makes a second request with no cookies and asserts the cookie from the first request is not visible

Without the fix, the second request sees session-secret=abc123 (bleed). With the fix it sees no cookies.

@abrom abrom left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few Rubocop lints that needed addressing, but otherwise looks great. Nice one @wooly 👍

@abrom
abrom merged commit b334b5a into Studiosity:main Apr 2, 2026
7 checks passed
@abrom

abrom commented Apr 2, 2026

Copy link
Copy Markdown
Contributor

Released in v1.2.10

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants