BigPizzaV3/CodexPlusPlus · error · anyhow::Error

CDP WebSocket host must be loopback

Error message

CDP WebSocket host must be loopback

What it means

Security guard in validate_cdp_websocket_url: the WebSocket host parsed from the CDP URL is not a loopback IP, so connecting would send the DevTools protocol off-machine — rejected to prevent SSRF/exfiltration. The offending input is a non-127.0.0.1/::1 host in the returned webSocketDebuggerUrl.

Source

Thrown at crates/codex-plus-core/src/cdp.rs:225

    }
    Ok(targets)
}

pub fn validate_cdp_websocket_url(url: &str, expected_port: u16) -> anyhow::Result<()> {
    let parsed = reqwest::Url::parse(url).context("invalid CDP WebSocket URL")?;
    if !matches!(parsed.scheme(), "ws" | "wss") {
        bail!("CDP WebSocket URL must use ws or wss");
    }
    let host = parsed
        .host_str()
        .ok_or_else(|| anyhow::anyhow!("CDP WebSocket URL has no host"))?;
    let address = host
        .trim_start_matches('[')
        .trim_end_matches(']')
        .parse::<IpAddr>()
        .with_context(|| "CDP WebSocket host must be a loopback IP address")?;
    if !address.is_loopback() {
        bail!("CDP WebSocket host must be loopback");
    }
    let port = parsed
        .port()
        .ok_or_else(|| anyhow::anyhow!("CDP WebSocket URL must include an explicit port"))?;
    if port != expected_port {
        bail!("CDP WebSocket port {port} does not match debug port {expected_port}");
    }
    Ok(())
}

pub fn pick_page_target(targets: &[CdpTarget]) -> anyhow::Result<CdpTarget> {
    let mut first_page = None;
    for target in targets
        .iter()
        .filter(|target| is_injectable_page_target(target))
    {
        first_page.get_or_insert(target);
        if is_primary_codex_page_target(target) {

View on GitHub (pinned to f2074595a2)

Solutions

1. Launch the browser with remote debugging bound to loopback only
2. Rewrite the CDP URL to 127.0.0.1/[::1] when accessing via a forwarded host
3. Never connect to a DevTools WebSocket on a non-loopback host

When it happens

Trigger: Thrown at crates/codex-plus-core/src/cdp.rs:225 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BigPizzaV3/CodexPlusPlus@f2074595a2 (2026-08-23). Data as JSON: /api/errors/e695ea0d0a382abb. Report an issue: GitHub.