Support for Port 443 #869

reaperofpower · 2024-05-29T03:42:50Z

reaperofpower
May 29, 2024

does BB support direct 443 access or does it require a reverse proxy?

May 29, 2024

Hi @reaperofpower thanks for the question!

This is a great question. Easiest way is to use a reverse proxy right now but that does not seem ideal, so I'd like to expand a bit on the reasoning and maybe speculate as to other ways we could do this.

An alternate "fix" for now is you can "hide" the port by embedding the actual resource (in the example below, https://example.com:8002/login?token=example-token) in an iframe, like so:

https://example.com/index.html:

<!DOCTYPE html>
<meta name=viewport content="initial-scale=1,width=device-width">
<title>Browser</title>
<style>
  :root, body {
    margin: 0;
    padding: 0;
    height: 100%;
    overflow: hidden;
  }
</style>
<iframe 
  src="http…

View full answer

o0101 · 2024-05-29T04:38:07Z

o0101
May 29, 2024
Maintainer

Hi @reaperofpower thanks for the question!

This is a great question. Easiest way is to use a reverse proxy right now but that does not seem ideal, so I'd like to expand a bit on the reasoning and maybe speculate as to other ways we could do this.

An alternate "fix" for now is you can "hide" the port by embedding the actual resource (in the example below, https://example.com:8002/login?token=example-token) in an iframe, like so:

https://example.com/index.html:

<!DOCTYPE html>
<meta name=viewport content="initial-scale=1,width=device-width">
<title>Browser</title>
<style>
  :root, body {
    margin: 0;
    padding: 0;
    height: 100%;
    overflow: hidden;
  }
</style>
<iframe 
  src="https://example.com:8002/login?token=example-token"
  style="width: 100%; height: 100%; margin: 0; border: 0; padding: 0"
  allowfullscreen
  allow="
    accelerometer;
    camera;
    encrypted-media;
    display-capture;
    geolocation;
    gyroscope;
    microphone;
    midi;
    clipboard-read;
    clipboard-write;
    web-share;
    fullscreen;
  "
  sandbox="
    allow-same-origin
    allow-forms 
    allow-scripts
    allow-top-navigation-by-user-activation
    allow-storage-access-by-user-activation
    allow-popups
    allow-popups-to-escape-sandbox
    allow-downloads
    allow-modals 
    allow-pointer-lock
  " 
></iframe>

In that case, it should just work. If it doesn't, you might need to update ALLOWED_3RD_PARTY_EMBEDDERS in ./src/common.js to add your domain pattern.

To brainstorm about possible alternatives or better ways, it's helpful to recap the reasons for the current design. These are:

BB typically runs multiple instances per server, under non-privileged users, so binding system ports (<1024) is normally off limits without sudo. While you can have some superuser run sudo setcap 'cap_net_bind_service=+ep $(which node) to bind 443 and other ports less than 1024 without root privileges, this is still not possible for BB with the current config, for reasons that hopefully become clear below.
BB actually is a collection of 5 services running on 5 ports: the back-end browser (PORT-3000), the audio service (PORT-2), the document viewer service (PORT-1), the main application (PORT), the DevTools service (PORT+1).
BB runs the browser on a port that is 3000 less than the main application port. This means that, by default, running the app on 443, would attempt to run that browser on port -2557 which wouldn't work. For that reason, the minimum port is 4024, so neither browser nor app need privileges nor setcap, and both run on valid ports.
The reason for the 3000 port difference is, when setting firewall rules on cloud providers (our typical deployment environment), it's easy to set a block of ports. In addition, it's helpful to have simple rules for firewall ports in general, cloud provider or not, to make it easy to verify correctness and limit maintenance difficulties. The result is we can open up ports 8000 - 10999, and applications running in that range will run their browsers on ports in the range 5000 - 7999. In this way browser ports will not overlap with app ports, and we can put browser ports in a range that we do not open in the firewall. Even tho the browsers only bind to the local interface (and not 0.0.0.0), it's good practice to keep the port blocks isolated from each other, with clear firewall rules to lock down access.

So, given the above considerations for the present design, what alternatives might permit an easy utilization of the conventional port for HTTPS, 443?

We could modify the code in places where 3000 is hardcoded to replace it with a reference to the browser port. Which could become, say, 10000 above, rather than 3000 below, giving all the benefits of easy firewall maintenance and secure local binding, while not limiting the minimum app port.
We could update deploy-scripts/_setup_bbpro.sh to permit a minimum port lower than the currently allowed 4024.
If the port is within the system port privilege range of 0 - 1023, we could show a message saying that running setcap on the node binary is required.

It seems the above modifications would permit something like the conventional binding to 443 that you seem to desire.

Hope this helps! :)

2 replies

reaperofpower May 29, 2024
Author

More context may help, non-standard ports are blocked on most public/commercial wifi so if I want to make sure my webapp will work everywhere it has to be deployed to port 80/443. Iframe would not work around the block

o0101 May 29, 2024
Maintainer

Oh I see, @reaperofpower! In that case it's more tricky then. It seems as if a reverse proxy may be the fastest way to get set up.

Alternately you might wish to consider the following two options:

the route we use for deploying as Tor hidden service: each service has its own Tor domain name (onion address), avoiding non standard ports entirely. This could either be used as is over Tor or the code paths adapted to deliver all 4 services (audio, devtools, docs and browser) to 4 separate reverse proxies.
the route we use for running on routers without a hostname: SSH tunnels. See here for more: https://blog.dosyago.com/tutorials/2023/06/17/tunneling-browserbox-pro-over-SSH-complete-guide-to-using-port-forwarding-to-run-RBI-on-a-router.html

Maybe I'm misunderstanding you, however, all this seems as if it might be a little too complex for a personal set up, is that right?

I wonder if it might not be better to create the 443 version. The issue for us right now is we're just super busy with existing deployments and customizations, so while I'd love to be able to say, "This is when we will get to this," I really don't know right now. I'm sorry about that, I'm sure this is not the answer you're looking for!

This will probably seem really cheap of us and annoying but would you be interested in doing this work yourself? We'd be happy to accept a PR! :) Totally understand if not, totally okay, just might be easier.

We could always create a customization for this, but I'm not sure you'd feel that's justified. Otherwise we can place it in our task list and come to it when we've completed the existing queue. I'm sure that's probably not what you want to hear. Hopefully this helps, tho!

o0101 · 2024-06-13T10:39:57Z

o0101
Jun 13, 2024
Maintainer

Hello @reaperofpower

Recent changes have made it much easier to run full BrowserBox (audio, docs, devtools and browser) behind a reverse proxy. Our CloudTabs SaaS also bears these changes now, and should be accessible from networks that block non-standard ports. Please check it out and see if that works for you.

If you've had issues we recommend re-installing from the latest boss branch.

Thank you for your report!

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support for Port 443 #869

{{title}}

Replies: 2 comments 2 replies

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Support for Port 443 #869

reaperofpower May 29, 2024

Replies: 2 comments · 2 replies

o0101 May 29, 2024 Maintainer

reaperofpower May 29, 2024 Author

o0101 May 29, 2024 Maintainer

o0101 Jun 13, 2024 Maintainer

reaperofpower
May 29, 2024

Replies: 2 comments 2 replies

o0101
May 29, 2024
Maintainer

reaperofpower May 29, 2024
Author

o0101 May 29, 2024
Maintainer

o0101
Jun 13, 2024
Maintainer