From 77ee84c2fa696aef807bce5eec53497e04dbeea5 Mon Sep 17 00:00:00 2001 From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com> Date: Mon, 2 Nov 2026 19:46:01 +0000 Subject: [PATCH 1/2] Document browser port 443 allowlist requirements --- info/network-access.mdx | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/info/network-access.mdx b/info/network-access.mdx index 44ea7259..dbf0bf42 100644 --- a/info/network-access.mdx +++ b/info/network-access.mdx @@ -14,7 +14,7 @@ Allow only the destinations used by your integration. Apply the Live View and re | --- | --- | --- | --- | | API, SDKs, and authenticated CLI requests | `api.onkernel.com` | `443` | HTTPS | | CLI authentication (`kernel login`) | `auth.onkernel.com`, `dashboard.onkernel.com` | `443` | HTTPS | -| CDP, WebDriver BiDi, Live View, replays, and app connections | `*.onkernel.com`, `*.kernel.sh` | `8443` | HTTPS and secure WebSocket (WSS) | +| CDP, WebDriver BiDi, Live View, replays, and app connections | `*.onkernel.com`, `*.kernel.sh` | `443`, `8443` | HTTPS and secure WebSocket (WSS) | | Live View media negotiation | `stun.relay.metered.ca` | `80` | STUN over UDP | | Live View media relay | `global.relay.metered.ca` | `443` | TURN over UDP or TLS/TCP | | Replay files | `kernel-api-prod.s3.us-east-1.amazonaws.com` | `443` | HTTPS | @@ -23,6 +23,8 @@ Allow only the destinations used by your integration. Apply the Live View and re Allow both wildcard domains. Don't copy a single hostname from a returned `cdp_ws_url`, `webdriver_ws_url`, or `browser_live_view_url`, because that hostname can change between sessions. +browser urls are moving to port `443`, which omits `:8443`. allow both ports during the rollout and use urls returned by the api without rewriting them. + ## Content security policy A network allowlist permits traffic leaving your environment. A Content Security Policy (CSP) permits content loaded by your web application. If you embed Live View or replays, configure both. @@ -32,9 +34,15 @@ A network allowlist permits traffic leaving your environment. A Content Security Merge these sources into your application's existing CSP: ```text -frame-src https://*.onkernel.com:8443 +frame-src https://*.onkernel.com + https://*.kernel.sh + https://*.onkernel.com:8443 https://*.kernel.sh:8443; -connect-src https://*.onkernel.com:8443 +connect-src https://*.onkernel.com + wss://*.onkernel.com + https://*.kernel.sh + wss://*.kernel.sh + https://*.onkernel.com:8443 wss://*.onkernel.com:8443 https://*.kernel.sh:8443 wss://*.kernel.sh:8443; @@ -45,7 +53,9 @@ connect-src https://*.onkernel.com:8443 Merge these sources into your application's existing `frame-src` directive: ```text -frame-src https://*.onkernel.com:8443 +frame-src https://*.onkernel.com + https://*.kernel.sh + https://*.onkernel.com:8443 https://*.kernel.sh:8443 https://kernel-api-prod.s3.us-east-1.amazonaws.com; ``` @@ -54,6 +64,6 @@ frame-src https://*.onkernel.com:8443 - If API, SDK, or authenticated CLI requests time out, verify access to `api.onkernel.com:443`. - If `kernel login` doesn't complete, verify access to `auth.onkernel.com:443` and `dashboard.onkernel.com:443`. -- If browser creation succeeds but CDP, WebDriver BiDi, or Live View won't connect, verify access to both wildcard domains on port `8443`. +- If browser creation succeeds but CDP, WebDriver BiDi, or Live View won't connect, verify access to both wildcard domains on ports `443` and `8443`. - If Live View loads but remains disconnected or doesn't show video, verify access to the STUN and TURN destinations. - If the replay player loads but a recording doesn't play, verify access to the replay file destination. From 848ad18eb917d23bdef443a4edb9f5ab416b1f59 Mon Sep 17 00:00:00 2001 From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com> Date: Mon, 2 Nov 2026 21:26:34 +0000 Subject: [PATCH 2/2] Include port 443 in embedding CSP and security scope --- browsers/live-view.mdx | 10 ++++++++-- browsers/replays.mdx | 2 +- info/network-access.mdx | 2 +- security-vulnerability-reporting.mdx | 2 +- 4 files changed, 11 insertions(+), 5 deletions(-) diff --git a/browsers/live-view.mdx b/browsers/live-view.mdx index 921bb746..3692ca7c 100644 --- a/browsers/live-view.mdx +++ b/browsers/live-view.mdx @@ -79,9 +79,15 @@ If your environment restricts outbound traffic, allow the [Live View domains and If your application uses a **Content Security Policy (CSP)**, you must add the following directives to allow the live view iframe and its WebSocket connection. See [firewall allowlist](/info/network-access#content-security-policy) for the complete firewall and CSP requirements. ``` -frame-src https://*.onkernel.com:8443 +frame-src https://*.onkernel.com + https://*.kernel.sh + https://*.onkernel.com:8443 https://*.kernel.sh:8443; -connect-src https://*.onkernel.com:8443 +connect-src https://*.onkernel.com + wss://*.onkernel.com + https://*.kernel.sh + wss://*.kernel.sh + https://*.onkernel.com:8443 wss://*.onkernel.com:8443 https://*.kernel.sh:8443 wss://*.kernel.sh:8443; diff --git a/browsers/replays.mdx b/browsers/replays.mdx index a0ffefb3..4f2ad2b3 100644 --- a/browsers/replays.mdx +++ b/browsers/replays.mdx @@ -249,7 +249,7 @@ Replace `REPLAY_VIEW_URL` with the URL returned by the API: ```html
diff --git a/info/network-access.mdx b/info/network-access.mdx index dbf0bf42..a1b46f1a 100644 --- a/info/network-access.mdx +++ b/info/network-access.mdx @@ -23,7 +23,7 @@ Allow only the destinations used by your integration. Apply the Live View and re Allow both wildcard domains. Don't copy a single hostname from a returned `cdp_ws_url`, `webdriver_ws_url`, or `browser_live_view_url`, because that hostname can change between sessions. -browser urls are moving to port `443`, which omits `:8443`. allow both ports during the rollout and use urls returned by the api without rewriting them. +Browser URLs are moving to port `443`, which omits `:8443`. Allow both ports during the rollout and use URLs returned by the API without rewriting them. ## Content security policy diff --git a/security-vulnerability-reporting.mdx b/security-vulnerability-reporting.mdx index 94a30a54..62b29dec 100644 --- a/security-vulnerability-reporting.mdx +++ b/security-vulnerability-reporting.mdx @@ -81,7 +81,7 @@ Reports against Tier 1 assets receive the highest bounty consideration and are r | Asset | Surface | |---|---| | `api.onkernel.com` | Control plane REST API: `/browsers`, `/browser_pools`, `/auth/connections`, `/credentials`, `/profiles`, `/proxies`, `/extensions`, `/apps`, `/deployments`, `/invocations`, `/projects`, `/org/*`, `/audit-logs`, `/authmd/*` | -| `*.kernel.sh:8443` | Metro data plane: `/browser/cdp`, `/browser/webdriver/session`, `/browser/live`, `/browser/live/{slug}`, `/browser/replays`, `/browser/kernel/*`, `/apps/*` | +| `*.kernel.sh:443`, `*.kernel.sh:8443` | Metro data plane: `/browser/cdp`, `/browser/webdriver/session`, `/browser/live`, `/browser/live/{slug}`, `/browser/replays`, `/browser/kernel/*`, `/apps/*` | | Session tokens | Session JWT issuance, validation, scoping, expiry, and revocation | | **VM and session isolation** | Escape from a browser session VM to the host or hypervisor; cross tenant access between sessions; isolation boundary bypasses; leakage of credentials, cookies, or profile data across session boundaries | | `dashboard.onkernel.com` | Customer dashboard, org and project authorization boundaries |