docs: add URLAllowlist navigation-restriction example to chrome policies - #478
Conversation
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Risk assessment: Very Low
Verdict: Approve
Evidence (from diff only)
- 1 file changed:
browsers/chrome-policies.mdx(+32 / −0) - Adds a documentation section with Python and TypeScript examples for
URLBlocklist/URLAllowlistChrome policies - No application code, config, CI, infrastructure, auth, or API surface changes
- No CODEOWNERS file present for this path; no prior approvals to re-evaluate
Why Very Low
This is a small, docs-only addition on a Mintlify documentation page. Blast radius is limited to published docs content; there is no production logic or shared-system impact.
Action: Approving per Very Low risk criteria.
Sent by Cursor Automation: Assign PR reviewers
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit ccb1161. Configure here.
|
|
||
| ### Restrict navigation to specific URLs | ||
|
|
||
| To lock a browser to an approved set of URLs, block everything with `URLBlocklist` and then allow back only the URLs you want with `URLAllowlist`. Entries match a whole domain (`chatgpt.com`) or a specific path (`en.wikipedia.org/wiki/Cat`), and more specific entries take precedence. This gates top-level navigation, so any other URL returns `ERR_BLOCKED_BY_ADMINISTRATOR`; it does not block resources or API calls a permitted page loads from other origins. |
There was a problem hiding this comment.
Dense intro needs bullet list
Low Severity
The new “Restrict navigation” intro packs several separable points—block-all plus allowlist, domain vs path-style entries, precedence, top-level ERR_BLOCKED_BY_ADMINISTRATOR, and sub-resource exceptions—into one dense paragraph instead of a lead-in plus bullets per documentation style rules.
Triggered by learned rule: Use bullet lists when covering multiple distinct points in guides
Reviewed by Cursor Bugbot for commit ccb1161. Configure here.




Summary
Adds a "Restrict navigation to specific URLs" section to
browsers/chrome-policies.mdx, directly below "Block DevTools and page source", showing the allowlist-only pattern:{ "URLBlocklist": ["*"], "URLAllowlist": ["chatgpt.com", "en.wikipedia.org/wiki/Cat"] }Same level of detail and structure as the DevTools section (intro paragraph + Python/TS
CodeGroup).Notes
ERR_BLOCKED_BY_ADMINISTRATOR) but does not block sub-resources or API calls a permitted page loads from other origins.🤖 Generated with Claude Code
Note
Low Risk
Docs-only change with no runtime, API, or security logic modifications.
Overview
Adds a Restrict navigation to specific URLs common-use-case section to
browsers/chrome-policies.mdx, placed after the DevTools blocklist example.The section documents the block-all-then-allow pattern (
URLBlocklist: ["*"]plusURLAllowlistfor approved domains/paths), including how matching and precedence work and that only top-level navigation is gated (ERR_BLOCKED_BY_ADMINISTRATOR), not sub-resources or cross-origin APIs on allowed pages. Python and TypeScriptbrowsers.create()snippets mirror the existing DevTools section format.Reviewed by Cursor Bugbot for commit ccb1161. Bugbot is set up for automated code reviews on this repo. Configure here.