Access with boundaries

Browser-scoped tokens, explicit permissions and bounded renewal.

One browser. One audience. Explicit access.

CDP permits powerful reads and execution; it is not read-only. Live View defaults to view-only, with input permission enforced at the gateway.

Live View sharing: reusable URLs, short-lived credentials

A Live View URL is a manageable access grant for one browser. By default it is a reusable share link with read-only permission and no expiration. The recipient signs in and accepts shared access into their browser library before viewing. The CLI returns or opens the URL and exits; no ownership transfer occurs.

1. Open https://cloudbrowser.tv/view/{linkId}#share=…. The account shell reads and removes the fragment, preserves a secure pending acceptance across login, and validates the invitation when the recipient signs in.
2. Accepting the share saves an account-to-browser access relationship referencing the current grant. A one-time invitation is claimed once, atomically, by the accepting account. Reusable shares can be accepted by multiple recipients.
3. The account requests a short-lived, runtime-bound viewer ticket using its saved access. Only that ticket crosses to the isolated viewer; the account cookie and workspace API key never do.
4. The same workspace expands to the single-browser viewer. Minimize to the grid with the shared browser saved in the account. Refreshing credentials remains bounded by the source link’s current authorization.

Read the grid, fullscreen and account-library design ↗

# Reusable, read-only, no expiration
cloudbrowser view br_123 --permission view --output json

# Allow browser operation for the next 24 hours
cloudbrowser view br_123 --permission control --expires-in 24h --output json

A link created at 10:00 with a 24-hour deadline stops authorizing access at 10:00 the next day, even if opened at 23:00. A 5-minute entry ticket only needs to be exchanged before its own deadline. A link with no expiration has no 24-hour or 7-day renewal cap.

Read-only versus read & write

The gateway enforces permissions on every remote-input channel. Hiding buttons is not authorization. A permission update increments the link revision and immediately ends all old sessions and outstanding tickets, including on upgrade. Reopen the same share URL for the new permission; a refresh cannot silently elevate an existing session.

Manage CDP connections

Open Connect on an owned browser to create CDP tokens, review expiry and renewal deadlines, renew eligible tokens, or revoke access. This dialog only manages that browser’s tokens. The workspace sidebar remains, without a separate CDP tokens page. Shared viewers cannot access these controls.

Manage active links

The sharing dialog on each owned browser lists its links, permission, access deadline, status, last-opened time and authorized session count. Filter active or inactive links, change permission/deadline, end current sessions, or revoke a link. Ending sessions keeps a share URL available for a future visit; revoking the link also blocks every future visit. Revocation is terminal.

cloudbrowser links list br_123 --status active
cloudbrowser links update br_123 grant_123 --permission view --expires-in 24h
cloudbrowser links update br_123 grant_123 --never-expires
cloudbrowser links sessions br_123 grant_123
cloudbrowser links end-sessions br_123 grant_123 --yes
cloudbrowser links revoke br_123 grant_123 --yes

Policy updates invalidate old sessions even when extending an expired link; they do not resurrect old credentials. Editing permission/deadline applies to reusable shares; create a new grant for a direct one-time link. Lists return metadata only. The raw URL is returned once at issuance and is not retrievable from listing endpoints. Copy it before closing the dialog. Account library entries store grant references, never raw share tokens.

Viewer cookies, runtime and refresh

Use the isolated view.cloudbrowser.tv origin. Access/refresh cookies are HttpOnly, Secure, SameSite=Strict and host-only, scoped to /b/{browserId}/. The fullscreen account shell remains on cloudbrowser.tv; an embedded isolated viewer receives only a short-lived ticket using a strict origin-checked exchange. Multiple recipients have independent sessions; one local browser profile shares its current session for a given cloud browser across tabs. Coordinate same-browser refreshes to avoid rotation races. Cookie paths are not an authorization boundary: validate exact browser, link revision, permission and runtime.

Refresh tokens rotate atomically, with reuse detection invalidating the session family. Access/refresh secrets never enter JavaScript or localStorage. Share secrets and entry tickets are read briefly to exchange after URL-fragment removal; never send them to analytics or logs. Enforce exact Origin, CSRF protection, no-store/no-referrer and rate limits on redemption. No workspace API key is sent to the viewer.

Pause/runtime replacement ends existing sessions and tickets. The reusable share link remains configured; after the owner resumes the browser, the recipient can reopen that URL. Viewing a paused browser must not implicitly resume it or incur compute charges. Browser deletion, link revocation or issuer access removal prevents future visits and closes current streams. Forks do not inherit links.

Each viewer receives an independent session, so grid previews, expanded views and other tabs do not overwrite one another’s cookies. Read-only input is rejected by the server. Auth0 identities map to separate accounts and workspaces; verified-email invitations control preview access.

CDP keeps its own renewal policy

CDP tools do not load the viewer webpage or implement its cookie refresh protocol. The existing CDP lease design remains separate: default TTL 1 hour, allowed 5 minutes–24 hours; optional renewal has an immutable hard stop within 7 days of issuance.

cloudbrowser connect br_123 --audience cdp --ttl 1h --auto-renew --max-lifetime 24h --watch

Only CDP uses the authenticated CLI/console manager and --watch. Renewal updates expiresAt = min(now + original TTL, renewUntil) while preserving the opaque CDP token. Expired or revoked CDP grants cannot renew. Live View refresh does not use the management grant-renew endpoint.

Revoke existing connections too

The gateway must recheck grants after the initial handshake. Expiry, revocation, workspace access removal, browser deletion and runtime replacement close existing sockets and invalidate viewer sessions. Viewer refresh checks the original grant, current issuer authorization and runtime generation; it does not require the link recipient to repeatedly sign in during an active authorized session. Initial account acceptance is required. Logout revokes the session family; grant revocation also invalidates its unused ticket. Existing streams close when access expires, unless reauthenticated after renewal. Expired access alone does not invalidate a still-valid refresh session.

Isolation beyond a token

• Authorize every browser and grant lookup against its workspace; an unpredictable ID is not authorization.
• Keep Chrome CDP and VNC on sandbox loopback, behind the authenticated gateway.
• Store only hashes of opaque bearer tokens. Never return secret tokens from list endpoints.
• Redact tokens and URL query strings from logs, analytics and traces. Use no-store responses and no-referrer on connection surfaces.
• Serve viewer content from an isolated origin with a strict CSP and Origin checks. Reject input traffic for view-only grants.
• Browser forks copy sensitive login state but never copy connection grants.
• Enforce egress restrictions for internal and cloud-metadata destinations; sandbox isolation alone is not an SSRF policy.

Design reference: OWASP WebSocket Security. Policy durations above are local defaults, not production service guarantees. Local HTTP cookies omit Secure; deployed HTTPS must enable it.