Question
Unable to connect to hub at http://<IP>:4444/grid/register – Selenium Grid Hub
Rey Nea
0 reputation · 13 Aug 2021, 14:30 UTC
31.4K views
Loading…
0 reputation · 13 Aug 2021, 14:30 UTC
Selenium Grid 4 hubs bind to 0.0.0.0 by default, which allows the hub to be reachable from any network interface. While this facilitates node registration across different networks, it introduces a security gap because the hub lacks built-in authentication or authorization mechanisms.
In cloud-based deployments, this default behavior may inadvertently expose the test infrastructure to public networks. Currently, the documented approach to secure the hub relies on external layers such as firewalls or reverse proxies rather than native configuration parameters.
Given the lack of native identity management in the hub, how can operators ensure that only authorized nodes can register and submit sessions without introducing significant latency via a proxy? Is there a planned configuration for native authentication in upcoming releases?
35275 reputation · 13 Aug 2021, 17:44 UTC
Because Selenium Grid 4 lacks native application-layer authentication for the /grid/register endpoint, you cannot restrict node registration via a configuration file or internal setting. To ensure only authorized nodes can register and submit sessions without introducing the latency of a full-featured reverse proxy, you must implement network-level access control.
The most efficient way to secure the hub is to restrict traffic at the OS or Cloud infrastructure level. This prevents unauthorized packets from reaching the Hub process entirely, eliminating proxy overhead.
selenium4444 only from the specific IP addresses or CIDR blocks of your authorized Node instances.ufw:
sudo ufw allow from <NODE_IP> to any port 4444 proto tcp| Method | Latency Impact | Security Level | Complexity |
|---|---|---|---|
| Network Firewall | Negligible | High (L3/L4) | Low |
| Reverse Proxy | Low to Moderate | High (L7) | Moderate |
| VPN/VPC Peering | Low | Very High | High |
To verify that your security constraints are working and that the Hub is correctly bound, run the following on the Hub host:
# Confirm the Hub is listening on all interfaces (0.0.0.0)
netstat -tulpn | grep 4444From a Node machine, test the connection to the registration endpoint:
curl -v http://<HUB_IP>:4444/statusThis guidance assumes you are using a standard Selenium Grid 4 deployment. There is currently no documented native identity management or API key system planned for the Hub's registration process in the core project; security remains the responsibility of the infrastructure layer. If you are using a managed Selenium provider, these controls may be handled by the provider's proprietary orchestration layer.
Diagnostic Detail Needed: Are your Nodes and Hub residing within the same Virtual Private Cloud (VPC) or across different physical networks?
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.