fix(mcp): validate Host and Origin on CDP relay WebSocket upgrades - #42103
Merged
Conversation
The relay HTTP server only binds to localhost, but the WebSocket upgrade accepted any Host header (DNS rebinding) and any Origin. Reject upgrades with a non-loopback Host or a web page Origin; the legitimate clients are the local Playwright client (no Origin) and the extension (chrome-extension:// Origin). Fixes: microsoft/playwright-mcp#1694
Extract the Host allowlist check from HttpServer._onRequest into isAllowedHost(), enforce it on createWebSocket() upgrades, and reuse it together with the shared loopback host set in the CDP relay.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Replace the raw ws server and custom verifyClient in CDPRelayServer with WSServer, which now validates the Host allowlist on upgrades in addition to Origin. Restrict the WSServer origin check to http(s) origins so that extension connections are allowed.
Rename isValidPathname to isAllowedPathname, require it in the delegate and define it at all callsites. Drop the unused path parameter of the PlaywrightWebSocketServer constructor.
Also pass the ws path to the PlaywrightWebSocketServer constructor instead of listen().
Allow WSServerDelegate.onConnection to return undefined instead of a no-op connection, align the upgrade 403 status line in HttpServer with WSServer.
Contributor
Test results for "tests 1"10 flaky51189 passed, 1188 skipped Merge workflow run. |
Contributor
Test results for "MCP"1 failed 7971 passed, 1284 skipped Merge workflow run. |
Contributor
|
Hi, I'm the Playwright bot and I took a first look at the CI failures here. 🟢 The one failure is a known flake — this PR is clear
DetailsOverall: the diff is confined to the extension CDP relay and the shared WS/HTTP host-origin check. The failing test exercises the ordinary MCP Pre-existing flake / infra
Triaged by the Playwright bot - agent run Triaged by the Playwright bot - agent run |
Pavel Feldman (pavelfeldman)
approved these changes
Aug 4, 2026
Yury Semikhatsky (yury-s)
merged commit Aug 4, 2026
40d39ac
into
microsoft:main
50 of 51 checks passed
This was referenced Aug 5, 2026
Yury Semikhatsky (yury-s)
added a commit
to microsoft/playwright-mcp
that referenced
this pull request
Aug 6, 2026
## What's New ### Tool Improvements - **`browser_take_screenshot` — WebP format** — New `type` option to pick the image format (`png`, `jpeg` or `webp`); when unset, the format is inferred from the filename extension ([#41152](microsoft/playwright#41152)) - **`--codegen` — more languages** — Code generation now supports `python`, `java` and `csharp` in addition to `typescript` ([#42106](microsoft/playwright#42106)) - **Configurable settle delay** — New `--timeout-settle` flag (and `timeouts.settle` config option) to control how long to wait after each action for triggered work (navigations, requests) to settle, defaults to 500ms ([#41924](microsoft/playwright#41924)) ## Fixes - Aria snapshot capture is skipped when the response discards it ([#41923](microsoft/playwright#41923)) - New `--snapshot-boxes` flag (and `snapshot.boxes` config option) to enable bounding boxes in snapshots globally — previously this was only available per command ([#42102](microsoft/playwright#42102)) - Reconnect to the browser after a disconnect ([#41966](microsoft/playwright#41966)) - Report malformed JSON config instead of silently falling back to INI parsing ([#41909](microsoft/playwright#41909)) - Clear the dialog modal state when a dialog is closed out of band ([#42032](microsoft/playwright#42032)) - Detect downloads via the download event instead of guessing from `net::ERR_ABORTED` navigation errors ([#41933](microsoft/playwright#41933)) - Surface the missing executable path when a browser isn't installed ([#41941](microsoft/playwright#41941)) - Escape user input in codegen output ([#41962](microsoft/playwright#41962)) - Removed the stale `--output-mode` CLI option ([#41833](microsoft/playwright#41833)) ### Browser Extension - Validate `Host` and `Origin` headers on CDP relay WebSocket upgrades ([#42103](microsoft/playwright#42103)) - Launch the Chrome profile that has the extension installed ([#41939](microsoft/playwright#41939)) - Pass `noDefaults` for extension CDP connections ([#42119](microsoft/playwright#42119)) - Mention `PLAYWRIGHT_MCP_EXECUTABLE_PATH` in the error shown when the browser executable is not found ([#42122](microsoft/playwright#42122)) - Removed support for extension protocol v1 ([#41857](microsoft/playwright#41857))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hostheader or anhttp(s)Origin. Legitimate clients are unaffected: the local Playwright client sends no Origin, the extension's Origin ischrome-extension://.Fixes microsoft/playwright-mcp#1694