puppeteer/puppeteer · error · Error

Navigation to ${url} is blocked by blocklist/allowlist rules

Error message

Navigation to ${url} is blocked by blocklist/allowlist rules

What it means

Thrown by Frame.goto() when the target URL is rejected by the page's blocklist/allowlist rules. Puppeteer checks page._isUrlAllowed(url) (which delegates to the target manager's isUrlAllowed) before issuing any navigation, so this guards against navigating to disallowed hosts/schemes. The decorator @throwIfDetached also runs first, so this specific throw only fires on an attached frame whose URL filter rejects the URL.

Source

Thrown at packages/puppeteer-core/src/cdp/Frame.ts:158

    this.#client = client;
  }

  override page(): CdpPage {
    return this._frameManager.page();
  }

  @throwIfDetached
  override async goto(
    url: string,
    options: {
      referer?: string;
      referrerPolicy?: string;
      timeout?: number;
      waitUntil?: PuppeteerLifeCycleEvent | PuppeteerLifeCycleEvent[];
    } = {},
  ): Promise<HTTPResponse | null> {
    if (!this.page()._isUrlAllowed(url)) {
      throw new Error(
        `Navigation to ${url} is blocked by blocklist/allowlist rules`,
      );
    }

    const {
      referer = this._frameManager.networkManager.extraHTTPHeaders()['referer'],
      referrerPolicy = this._frameManager.networkManager.extraHTTPHeaders()[
        'referer-policy'
      ],
      waitUntil = ['load'],
      timeout = this._frameManager.timeoutSettings.navigationTimeout(),
    } = options;

    let ensureNewDocumentNavigation = false;
    const watcher = new LifecycleWatcher(
      this._frameManager.networkManager,
      this,
      waitUntil,

View on GitHub (pinned to d484e21c17)

Solutions

1. Inspect the configured allowlist/blocklist on the BrowserContext or target manager and add the rejected host/scheme to the allow set (or remove it from the block set).
2. If you control the filter, loosen the rule so it matches the full origin you navigate to (including scheme and port).
3. Verify the exact URL string passed to goto() — print it before the call and compare against the allowlist pattern; trailing slashes, ports, and case can cause a mismatch.
4. If the filter is unintended, disable the blocklist/allowlist feature on the connection to restore unrestricted navigation.

Example fix

// before
await page.goto('http://app.local:3000'); // blocked by allowlist

// after — ensure the host is in the allowlist configuration, then:
await page.goto('http://app.local:3000');

// Validate against the same rule before navigating.
// Puppeteer does not expose isUrlAllowed publicly, so mirror your filter config:
function isLikelyAllowed(url, allowedHosts) {
  try {
    const u = new URL(url);
    return allowedHosts.includes(u.host);
  } catch { return false; }
}
if (isLikelyAllowed(targetUrl, allowedHosts)) {
  await page.goto(targetUrl);
}

function isNavigatableUrl(url: unknown): url is string {
  return typeof url === 'string' && /^https?:\/\/.+/.test(url);
}

try {
  await page.goto(url);
} catch (e) {
  if (e instanceof Error && /blocked by blocklist\/allowlist/.test(e.message)) {
    // URL not permitted by filter; skip or reconfigure
  } else throw e;
}

When it happens

Trigger: Calling frame.goto(url) or page.goto(url) when the browser/connection was configured with a URL blocklist/allowlist (e.g. browser-level filtered browsing, custom BrowserContext request filters, or a ForkedTransport/extension filter) and url does not satisfy the allow rules. Also triggered if the allowlist is set but the URL host is not whitelisted, or the URL matches a deny entry.

Common situations: Corporate/enterprise Puppeteer deployments that restrict navigatable origins; custom CDP proxies that inject allowlist filters; misconfigured allowlist regex that accidentally excludes the intended domain; switching from http to https or to a subdomain not covered by the allowlist; localhost/dev-server URLs blocked by an overly strict host filter.

Related errors

• Zip symlink "${entry.fileName}" would point outside of the t
• Integrity check failed for downloaded browser archive. URL
• Trying to evaluate JSHandle from different frames. Usually t
• Execution context was destroyed, most likely because of a na
• Execution context was destroyed, most likely because of a na

AI-assisted analysis of puppeteer/puppeteer@d484e21c17 (2026-08-12). Data as JSON: /api/errors/a1461f35bea15e42. Report an issue: GitHub.