fix(mcp): validate Host and Origin on CDP relay WebSocket upgrades - #42103
Open
yury-s wants to merge 7 commits into
Open
fix(mcp): validate Host and Origin on CDP relay WebSocket upgrades#42103yury-s wants to merge 7 commits into
yury-s wants to merge 7 commits into
Conversation
The relay HTTP server only binds to localhost, but the WebSocket upgrade accepted any Host header (DNS rebinding) and any Origin. Reject upgrades with a non-loopback Host or a web page Origin; the legitimate clients are the local Playwright client (no Origin) and the extension (chrome-extension:// Origin). Fixes: microsoft/playwright-mcp#1694
pavelfeldman
reviewed
Aug 3, 2026
Extract the Host allowlist check from HttpServer._onRequest into isAllowedHost(), enforce it on createWebSocket() upgrades, and reuse it together with the shared loopback host set in the CDP relay.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Replace the raw ws server and custom verifyClient in CDPRelayServer with WSServer, which now validates the Host allowlist on upgrades in addition to Origin. Restrict the WSServer origin check to http(s) origins so that extension connections are allowed.
Rename isValidPathname to isAllowedPathname, require it in the delegate and define it at all callsites. Drop the unused path parameter of the PlaywrightWebSocketServer constructor.
Also pass the ws path to the PlaywrightWebSocketServer constructor instead of listen().
Allow WSServerDelegate.onConnection to return undefined instead of a no-op connection, align the upgrade 403 status line in HttpServer with WSServer.
Contributor
Test results for "tests 1"10 flaky51189 passed, 1188 skipped Merge workflow run. |
Contributor
Test results for "MCP"1 failed 7971 passed, 1284 skipped Merge workflow run. |
Contributor
|
Hi, I'm the Playwright bot and I took a first look at the CI failures here. 🟢 The one failure is a known flake — this PR is clear
DetailsOverall: the diff is confined to the extension CDP relay and the shared WS/HTTP host-origin check. The failing test exercises the ordinary MCP Pre-existing flake / infra
Triaged by the Playwright bot - agent run Triaged by the Playwright bot - agent run |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hostheader or anhttp(s)Origin. Legitimate clients are unaffected: the local Playwright client sends no Origin, the extension's Origin ischrome-extension://.Fixes microsoft/playwright-mcp#1694