{"record":{"id":"a1461f35bea15e42","repo":"puppeteer/puppeteer","slug":"navigation-to-url-is-blocked-by-blocklist-allow","errorCode":null,"errorMessage":"Navigation to ${url} is blocked by blocklist/allowlist rules","messagePattern":"Navigation to (.+?) is blocked by blocklist/allowlist rules","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/puppeteer-core/src/cdp/Frame.ts","lineNumber":158,"sourceCode":"    this.#client = client;\n  }\n\n  override page(): CdpPage {\n    return this._frameManager.page();\n  }\n\n  @throwIfDetached\n  override async goto(\n    url: string,\n    options: {\n      referer?: string;\n      referrerPolicy?: string;\n      timeout?: number;\n      waitUntil?: PuppeteerLifeCycleEvent | PuppeteerLifeCycleEvent[];\n    } = {},\n  ): Promise<HTTPResponse | null> {\n    if (!this.page()._isUrlAllowed(url)) {\n      throw new Error(\n        `Navigation to ${url} is blocked by blocklist/allowlist rules`,\n      );\n    }\n\n    const {\n      referer = this._frameManager.networkManager.extraHTTPHeaders()['referer'],\n      referrerPolicy = this._frameManager.networkManager.extraHTTPHeaders()[\n        'referer-policy'\n      ],\n      waitUntil = ['load'],\n      timeout = this._frameManager.timeoutSettings.navigationTimeout(),\n    } = options;\n\n    let ensureNewDocumentNavigation = false;\n    const watcher = new LifecycleWatcher(\n      this._frameManager.networkManager,\n      this,\n      waitUntil,","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/puppeteer/puppeteer/blob/d484e21c17f6023826fefdcdeeb553e04a7aaed8/packages/puppeteer-core/src/cdp/Frame.ts#L140-L176","documentation":"Thrown by Frame.goto() when the target URL is rejected by the page's blocklist/allowlist rules. Puppeteer checks page._isUrlAllowed(url) (which delegates to the target manager's isUrlAllowed) before issuing any navigation, so this guards against navigating to disallowed hosts/schemes. The decorator @throwIfDetached also runs first, so this specific throw only fires on an attached frame whose URL filter rejects the URL.","triggerScenarios":"Calling frame.goto(url) or page.goto(url) when the browser/connection was configured with a URL blocklist/allowlist (e.g. browser-level filtered browsing, custom BrowserContext request filters, or a ForkedTransport/extension filter) and url does not satisfy the allow rules. Also triggered if the allowlist is set but the URL host is not whitelisted, or the URL matches a deny entry.","commonSituations":"Corporate/enterprise Puppeteer deployments that restrict navigatable origins; custom CDP proxies that inject allowlist filters; misconfigured allowlist regex that accidentally excludes the intended domain; switching from http to https or to a subdomain not covered by the allowlist; localhost/dev-server URLs blocked by an overly strict host filter.","solutions":["Inspect the configured allowlist/blocklist on the BrowserContext or target manager and add the rejected host/scheme to the allow set (or remove it from the block set).","If you control the filter, loosen the rule so it matches the full origin you navigate to (including scheme and port).","Verify the exact URL string passed to goto() — print it before the call and compare against the allowlist pattern; trailing slashes, ports, and case can cause a mismatch.","If the filter is unintended, disable the blocklist/allowlist feature on the connection to restore unrestricted navigation."],"exampleFix":"// before\nawait page.goto('http://app.local:3000'); // blocked by allowlist\n\n// after — ensure the host is in the allowlist configuration, then:\nawait page.goto('http://app.local:3000');","handlingStrategy":"validation","validationCode":"// Validate against the same rule before navigating.\n// Puppeteer does not expose isUrlAllowed publicly, so mirror your filter config:\nfunction isLikelyAllowed(url, allowedHosts) {\n  try {\n    const u = new URL(url);\n    return allowedHosts.includes(u.host);\n  } catch { return false; }\n}\nif (isLikelyAllowed(targetUrl, allowedHosts)) {\n  await page.goto(targetUrl);\n}","typeGuard":"function isNavigatableUrl(url: unknown): url is string {\n  return typeof url === 'string' && /^https?:\\/\\/.+/.test(url);\n}","tryCatchPattern":"try {\n  await page.goto(url);\n} catch (e) {\n  if (e instanceof Error && /blocked by blocklist\\/allowlist/.test(e.message)) {\n    // URL not permitted by filter; skip or reconfigure\n  } else throw e;\n}","preventionTips":["Keep your allowlist configuration in one place and validate target URLs against it before calling goto.","Log every goto URL during development to catch filter mismatches early.","Document the allowed origin set so callers do not attempt blocked URLs."],"tags":["navigation","url-filter","allowlist","blocklist","security"],"backgroundTag":null,"analyzedSha":"d484e21c17f6023826fefdcdeeb553e04a7aaed8","analyzedAt":"2026-08-12T06:33:19.665Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}