0

There are services like BrowserStack or Sauce Labs that help with testing and test automation on different browsers and devices.

But, in order to solve the problem of an application under test being behind the VPN or firewall, they implement and offer this idea of "local testing":

Local Testing establishes a secure connection between your machine and BrowserStack servers. Once you set up Local Testing, all URLs work out of the box, including those with HTTPS, multiple domains, as well as those behind a proxy or firewall, and much more.

What risks are we taking allowing the remote selenium server on BrowserStack access to the internal resources? How secure is this setup and is there anything we can do to improve security?

1

You are essentially allowing an external third party to access any resource reachable via HTTP from your computer. This includes resources on your local machine and inside your local network. The dangers of this should be obvious: if any sensitive information can be reached via HTTP(S) from your system it could be stolen by this third party.

And note that even data which are not accessible by HTTP might get stolen: if you don't use the Chrome extension but the provided binary you are executing third party code on your system with the same permissions as yourself. This code has thus access also to local files, mounted network volumes etc.

In other words: if you don't fully trust this service don't use it. Alternatively use it only within an environment which contains no data worth stealing and where no such data are reachable from inside the environment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.