A Session ID Is Not Browser Authority

2026-08-26

The first Remote Browser sketch worked in one terminal. We sent a remote shell command to co browser, it opened a tab, and it printed an identifier. For a demo, that looked finished.

Then we opened a second terminal.

The first connection was gone, so the next command had only the printed identifier. If we accepted it, anyone who copied the identifier could control the tab. If we rejected it, the original caller could not reconnect. A Host restart made the problem worse: the browser daemon could still be alive while the shell command had left no durable record of who owned its tab.

The identifier told us which browser object we meant. It told us nothing about who had authority over it.

The turn was deleting the exciting command

Our first instinct was to keep the demo and add checks around it. Instead, we removed navigation and wrote the ownership test first: Alice starts a session, Bob obtains its ID, and Bob asks for status, diagnosis, and stop. Every answer must look exactly like a nonexistent session. Alice reconnects through a new Host service instance and still sees her session. Repeating the same Start must not open a second tab; repeating Stop must not fail or close something else.

That test forced the protocol to carry less authority, not more data. The Host takes the owner from the authenticated OIP connection. There is no owner field in the request for a caller to spoof. The session ID only locates a private registry record after the owner matches. The record survives a Host restart and maps to a named tab in the existing browser daemon, so Remote Browser does not quietly become a second driver.

Only then did the original one-terminal demo become a real lifecycle: start, list, inspect, diagnose, stop, disconnect, and reconnect.

The next shortcut failed for the same reason

With ownership fixed, adding open looked trivial. It was not. Checking the first URL would still allow a redirect to a private address, a hostname to resolve differently on the next request, or a public page to fetch private and link-local subresources. An allowlist at the CLI boundary would make the demo look safe while the browser crossed a different boundary underneath it.

So diagnosis now reports navigation as unavailable. Relay control also fails closed: a signed OIP command authenticates its caller, but without the reviewed secure channel it does not hide browser-control plaintext from the Relay.

The useful lesson came from that second terminal. A session ID is a reference, not a capability. Once we treated it that way, retries, reconnects, restarts, and refusals became part of one authority model. Navigation can arrive later, after its whole network path—not just its first URL—can enforce the same kind of boundary.