How do I protect the ports that chromedriver use?

Question

Normally when I run chromedriver I always get this output which I\'m sure everyone gets when running chromedriver. It\'s not the whole output but a

Answer 1

This INFO message...

Please protect ports used by ChromeDriver and related test frameworks to prevent access by malicious code.

... was the result of a bug which got induced with ChromeDriver v2.46

---

Analysis

As per the discussion 2.46 produces unexpected debug.log file if verbose logging is enabled, within the InitLogging() function of logging.cc some logging messages were written too early even before logging::InitLogging is called (at the last line of the function). This turned out to be OK on Linux and Mac OS, where the default log destination is where it is expected. But on Windows, the default log destination is a file named debug.log.

So ChromeDriver team needed to remove the two VLOG calls to the end of the method, after calling logging::InitLogging.

This issue was addressed through a commit and the fix was available within ChromeDriver 73.x

Protecting the ports that chromedriver use

There is nothing much we can do about the port usage as @barancev mentions ChromeDriver attempts to find a free Ephemeral port using a system-dependent ephemeral port range detector. An ephemeral port is a short-lived endpoint that is created by the operating system when a program requests any available user port. The operating system selects the port number from a predefined range, typically between 1024 and 65535, and releases the port after the related TCP connection terminates.

By default, the system can create a maximum of approximately 4,000 ephemeral ports that run concurrently on Windows Server 2003 and approximately 16,000 on Windows Server 2008.

---

Solution

Upgrading to ChromeDriver 73.x will solve this issue.

---

Outro

These log messages were the reflection of ChromeDriver - Security Considerations.

ChromeDriver is a powerful tool, and it can cause harms in the wrong hands. While using ChromeDriver, please follow these suggestions to help keeping it safe:

• By default, ChromeDriver only allows local connections. If you need to connect to it from a remote host, use --whitelisted-ips switch on the command line to specify a list of IP addresses that are allowed to connect to ChromeDriver.
• If possible, run ChromeDriver with a test account that has no access to sensitive local or network data. ChromeDriver should never be run with a privileged account.
• If possible, run ChromeDriver in a protected environment such as Docker or virtual machine.
• Use firewall to prevent unauthorized remote connection to ChromeDriver.
• If you are using ChromeDriver through third-party tools such as Selenium Server, be sure to protect the network ports of those tools as well.
• Use the latest versions of ChromeDriver and Chrome.

You can find the list of restricted ports on Chrome here.

Answer 2

I too had the same issue, all i did was add https to the link. eg: driver.get("https://www.yahoo.com");

This solved the problem and my scripts are running.

Answer 3

This is just an informational message. Nothing to be worried about. Even I get the following message.

Starting ChromeDriver 83.0.4103.39 (ccbf011cb2d2b19b506d844400483861342c20cd-refs/branch-heads/4103@{#416}) on port 9515
Only local connections are allowed.
Please see https://chromedriver.chromium.org/security-considerations for suggestions on keeping ChromeDriver safe.
ChromeDriver was started successfully.

Let me breakdown the message and explain.

Part 1: Please protect ports used by ChromeDriver

This is applicable to any program. The ports need to be protected whereas outsiders are not allowed to access. Since you are using the default whitelisting in Chromedriver, you get the message Only local connections are allowed.

When you run this driver, it will enable your scripts to access this and run commands on Google Chrome.

This can be done via scripts running in the local network (Only local connections are allowed.) or via scripts running on outside networks (All remote connections are allowed.). It is always safer to use the Local Connection option. By default your Chromedriver is accessible via port 9515.

See this answer if you wish to allow all connections instead of just local.

Part 2: prevent access by malicious code

There are different kinds of scripts that check whether these ports are open. Since you have opened the Chromedriver only allowing local connections it is much safer, and you have to only worry about the scripts in your machine, that might try to hit the port of the Chromedriver.

But, if you had whitelisted IPs, other than the local connections, then you have to protect the ports using firewall rules, via the Cloud service provider or your Operating System.

For more information, please see the Security Configurations given be ChromeDriver.