search

ariya / phantomjs

Scriptable Headless Browser
http://phantomjs.org
BSD 3-Clause "New" or "Revised" License
29.46k stars 5.76k forks source link

Unable to use PhantomJS whilst limiting access by IP #15464

Closed jazz-it closed 3 years ago

jazz-it commented 3 years ago

Describe the problem I use a web application that incorporates PhantomJS for PDF generation. We're trying to harden security for that particular application, so we decided to limit the access by selecting a range of IP addresses for our whitelist. However, as soon as we did it, our web application start crashing when it can’t get the PDF due to PhantomJS needs to communicate with your servers in order to work properly. If that's true, please provide the IP range that we should put on our whitelist, so we could keep our security intact.

Versions Which PhantomJS version? Tip: run phantomjs --version Which OS: Linux, Windows, macOS? Linux

Steps to Reproduce

  1. Try to limit your visitors via allow (deny all) in .htaccess
  2. Generate PDFs with PhantomJS
  3. Check errors.

Actual behavior Error 500 caused by mod_security and PhantomJS.

Expected behavior I expected to be able to use my web application normally.

Additional context The required IP addresses of your servers needed for necessary communication should be included in docs for future reference.

ariya commented 3 years ago

What do you mean by "your servers"?

Which script did you run with PhantomJS?

jazz-it commented 3 years ago

InvoiceNinja. Here's the follow up that brought me here, so it may shed additional light to my original issue:

https://forum.invoiceninja.com/t/error-500-whilst-editing-the-quote-invoice-template/8239/4

ariya commented 3 years ago

PhantomJS is a command line tool, it does not access any server. You run it with a script (see the example and that script tells PhantomJS to connect somewhere. Since you still don't share exactly what the script is, it's impossible to know exactly what happened.

In all cases, this is not a valid issue with PhantomJS.

jazz-it commented 3 years ago

Sorry, my bad - I should have contacted the following guys (I thought you're in the same team): https://phantomjscloud.com/