Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: Browser tool SSRF policy blocks all hostname URLs - cannot navigate to any website [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#65107•Fetched 2026-04-12 13:25:31
View on GitHub
Comments
0
Participants
1
Timeline
4
Reactions
0
Author
JKamgangJKamgang
Participants
JKamgangJKamgang
Timeline (top)
labeled ×2cross-referenced ×1referenced ×1

Summary Browser tool refuses to navigate to any hostname-based URL, requiring IP-literal addresses instead, making it unusable for general web browsing.

Description The browser tool refuses to navigate to any hostname-based URL, requiring IP-literal addresses instead. This makes the browser tool unusable for general web browsing. No configuration override found to disable or relax this policy.

Error Message

Full error message when using browser tool:

text Navigation blocked: strict browser SSRF policy requires an IP-literal URL because browser DNS rebinding protections are unavailable for hostname-based navigation. Example commands attempted:

browser navigate to https://www.google.com → blocked

browser navigate to https://github.com → blocked

browser navigate to https://www.realtysouth.com → blocked

Attempted workarounds:

web_fetch tool (different error: 403 Forbidden with "Just a moment..." bot detection page)

Root Cause

text Navigation blocked: strict browser SSRF policy requires an IP-literal URL because browser DNS rebinding protections are unavailable for hostname-based navigation. Example commands attempted:

Fix Action

Fix / Workaround

Attempted workarounds:

Workaround: None identified. Manual copy-paste of web content required. Attempted fixes:

PR fix notes

PR #65128: fix: [Bug]: Browser tool SSRF policy blocks all hostname URLs

Description (problem / solution / changelog)

Summary

Fixes an issue where the browser tool SSRF policy incorrectly blocks all hostname-based URLs by respecting the dangerouslyAllowPrivateNetwork flag when checking for explicit hostname allowances.

Changes

  • Updated assertBrowserNavigationAllowed in navigation-guard.ts to skip private network block checks if opts.ssrfPolicy.dangerouslyAllowPrivateNetwork is explicitly false.

Testing

  • Ran npx vitest run navigation-guard.test.ts and cdp tests to verify navigation guard behavior remains correct.

Fixes openclaw/openclaw#65107

Changed files

  • extensions/browser/src/browser/navigation-guard.ts (modified, +1/-1)

Code Example

Full error message when using browser tool:

text
Navigation blocked: strict browser SSRF policy requires an IP-literal URL because browser DNS rebinding protections are unavailable for hostname-based navigation.
Example commands attempted:

browser navigate to https://www.google.com → blocked

browser navigate to https://github.com → blocked

browser navigate to https://www.realtysouth.com → blocked

Attempted workarounds:

web_fetch tool (different error: 403 Forbidden with "Just a moment..." bot detection page)
RAW_BUFFERClick to expand / collapse

Bug type

Crash (process/app exits or hangs)

Beta release blocker

No

Summary

Summary Browser tool refuses to navigate to any hostname-based URL, requiring IP-literal addresses instead, making it unusable for general web browsing.

Description The browser tool refuses to navigate to any hostname-based URL, requiring IP-literal addresses instead. This makes the browser tool unusable for general web browsing. No configuration override found to disable or relax this policy.

Steps to reproduce

Steps to Reproduce Attempt to open any website using browser tool:

text browser navigate to https://www.realtysouth.com Observe error:

text Navigation blocked: strict browser SSRF policy requires an IP-literal URL Attempt with other hostnames (google.com, github.com, any domain) - same error

Search for configuration options to disable SSRF policy - none found

Expected behavior

Expected Behavior Browser tool should navigate to normal URLs like https://www.example.com or https://google.com without requiring IP-literal addresses.

Actual behavior

Actual Behavior Navigation fails with error requiring IP-literal URL format.

OpenClaw version

OpenClaw: 2026.4.11 (769908e)

Operating system

OS: Ubuntu on WSL2 (6.6.87.2-microsoft-standard-WSL2)

Install method

Install: npm global

Model

Gemini 2.5 Flash (google/gemini-2.5-flash)

Provider / routing chain

openclaw -> direct -> google/gemini-2.5-flash (default route)

Additional provider/model setup details

NOT_ENOUGH_INFO - browser tool usage does not involve model routing.

Logs, screenshots, and evidence

Full error message when using browser tool:

text
Navigation blocked: strict browser SSRF policy requires an IP-literal URL because browser DNS rebinding protections are unavailable for hostname-based navigation.
Example commands attempted:

browser navigate to https://www.google.com → blocked

browser navigate to https://github.com → blocked

browser navigate to https://www.realtysouth.com → blocked

Attempted workarounds:

web_fetch tool (different error: 403 Forbidden with "Just a moment..." bot detection page)

Impact and severity

mpact and severity Affected users/systems/channels: All agent interactions requiring web browsing or external content retrieval.

Severity: High - blocks autonomous web research and information gathering.

Frequency: 100% of browser tool navigation attempts to hostname-based URLs.

Consequence: Agent cannot research legal requirements, access public websites, gather market intelligence, or verify online information autonomously. The browser tool is effectively non-functional.

Additional information

Note: The web_fetch tool is also blocked by website bot detection (403 errors with Cloudflare-style "Just a moment..." pages). Combined with browser tool SSRF policy, there is currently no working method for autonomous web content retrieval.

Last known good version: NOT_ENOUGH_INFO (no prior working version documented).

Workaround: None identified. Manual copy-paste of web content required. Attempted fixes:

None - no configuration options documented for browser SSRF policy

Question for Developers: Is there an SSRF allowlist configuration? Can this policy be disabled or relaxed for trusted domains?

extent analysis

TL;DR

The browser tool's strict SSRF policy is blocking navigation to hostname-based URLs, requiring an IP-literal URL format, and a potential fix involves configuring an SSRF allowlist or disabling the policy for trusted domains.

Guidance

  • Investigate the browser tool's configuration options to see if there is an undocumented way to disable or relax the SSRF policy.
  • Check if there is an SSRF allowlist configuration that can be used to whitelist specific trusted domains.
  • Consider reaching out to the developers or checking the documentation for any updates on configuring the SSRF policy.
  • As a temporary workaround, manual copy-paste of web content may be necessary.

Example

No code snippet is provided as the issue does not imply a specific code-based solution.

Notes

The lack of documentation on configuring the SSRF policy and the absence of a prior working version make it challenging to provide a definitive fix. The web_fetch tool's blockage by website bot detection adds to the complexity of the issue.

Recommendation

Apply workaround: Since there is no clear configuration option to disable or relax the SSRF policy, and no identified fix, using manual copy-paste of web content as a temporary workaround may be necessary until a more permanent solution is found.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Expected Behavior Browser tool should navigate to normal URLs like https://www.example.com or https://google.com without requiring IP-literal addresses.

#api#ssr#orchestration issue#cache issue#memory leak

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING