Camofox Browser
Secure Camofox: global access, user-state authorization, egress and telemetry
Read the actual key policies, avoid exposing an unauthenticated browser service, and inventory profiles, traces, uploads and crash reporting.
What you will learn
- CAMOFOX_API_KEY and the global access key protect different scopes.
- HTTP/HTTPS validation does not replace an egress policy.
- Profiles, traces and telemetry need explicit retention and disclosure decisions.
Before you start
- Basic HTTP and JSON knowledge
- An isolated service and an owned or permitted test page
Explain the chapter’s actual service boundary and verify the proposed observation or lifecycle fixture.
Key takeaways
- CAMOFOX_API_KEY and the global access key protect different scopes.
- HTTP/HTTPS validation does not replace an egress policy.
- Profiles, traces and telemetry need explicit retention and disclosure decisions.
Global access and sensitive-route keys are different controls
lib/auth.js implements a global CAMOFOX_ACCESS_KEY gate and a separate requireAuth helper used for sensitive routes. When the global key is absent, its middleware passes through for compatibility. Setting CAMOFOX_API_KEY alone therefore must not be described as automatically protecting the entire service. Inspect route coverage, configure the global boundary and keep the listener private unless remote access is deliberately secured.
The per-route helper accepts the API key or configured access key. Without either key, it allows socket-level loopback only outside production; otherwise it rejects. The global layer has explicit exceptions, including health and routes with configured dedicated keys. These distinctions should become acceptance tests. A shared bearer secret also does not establish a per-user ownership policy for caller-supplied userId values.
Browser navigation is a network capability
The reviewed validateUrl helper parses a URL and allows HTTP or HTTPS schemes. That check is not a destination allowlist, DNS policy or complete private-network protection. For a remotely reachable browser service, enforce permitted destinations and network egress outside this narrow helper, and test redirects and resource requests within your own environment. Do not infer safety from the fact that a URL starts with https.
Cookies, persisted profiles, uploads, downloads and trace archives create additional data boundaries. The configuration names separate directories for several of these artifacts. Give the service only necessary filesystem access, retain secrets through an appropriate secret store and define deletion and backup policy per artifact. Do not import a personal browser’s account state merely to populate a demonstration.
Treat diagnostics as data handling, not free observability
Crash reporting is enabled unless CAMOFOX_CRASH_REPORT_ENABLED is exactly false as a string in the inspected configuration. The reporter can send reports through a relay and applies redaction and domain hashing. Those transformations reduce exposure but do not prove that every diagnostic is non-sensitive. Decide whether reporting is appropriate before processing private pages; the local deployment example explicitly opts out.
Session tracing is separately opt-in and can include screenshots, DOM snapshots and network information. In the inspected tab-creation path, enabling tracing on an existing untraced session returns a conflict rather than silently toggling it. Plan a new isolated test session when needed; do not delete active user history to force a trace demonstration. No credentials were imported, external accounts accessed or production endpoints probed in this review.
Implementation steps
- 1
Verify unauthorized ordinary routes are rejected by the configured boundary.
- 2
Enforce caller ownership of userId and permitted destinations.
- 3
Inventory data directories, backups and trace retention.
- 4
Choose crash-reporting policy before visiting private content.
Copy-ready example
{"globalAccessGate":"required","userIdOwnership":"enforced by caller boundary","allowedDestinations":"owned fixtures only","crashReporting":"disabled for private test","trace":false,"credentialsImported":false}Frequently asked questions
Does CAMOFOX_API_KEY protect every route?
Do not assume that. The reviewed code has a separate global access-key middleware that passes through when its key is absent.
Does URL validation block every unsafe destination?
No. The inspected helper restricts schemes; destination and network controls require a broader policy.
Sources
- README.mdSource checked 2026-09-08
- package.jsonSource checked 2026-09-08
- DockerfileSource checked 2026-09-08
- lib/auth.jsSource checked 2026-09-08
- lib/snapshot.jsSource checked 2026-09-08
- lib/extract.jsSource checked 2026-09-08
- lib/config.jsSource checked 2026-09-08
- lib/reporter.jsSource checked 2026-09-08
- lib/page-lease.jsSource checked 2026-09-08
- server.jsSource checked 2026-09-08
- tests/unit/snapshot.test.jsSource checked 2026-09-08
- tests/unit/auth.test.jsSource checked 2026-09-08