{"id":49360633,"url":"https://github.com/inledgroup/bastion.browser","last_synced_at":"2026-04-27T16:10:04.494Z","repository":{"id":334273404,"uuid":"1140774857","full_name":"InledGroup/bastion.browser","owner":"InledGroup","description":"Bastion Browser is an advanced Remote Browser Isolation (RBI) solution designed to provide an impenetrable security layer between the user and threats from the public web.","archived":false,"fork":false,"pushed_at":"2026-02-01T16:13:58.000Z","size":387,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-02-02T01:19:33.386Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/InledGroup.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-01-23T18:39:25.000Z","updated_at":"2026-02-01T16:14:01.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/InledGroup/bastion.browser","commit_stats":null,"previous_names":["inledgroup/bastion.browser"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/InledGroup/bastion.browser","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/InledGroup%2Fbastion.browser","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/InledGroup%2Fbastion.browser/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/InledGroup%2Fbastion.browser/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/InledGroup%2Fbastion.browser/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/InledGroup","download_url":"https://codeload.github.com/InledGroup/bastion.browser/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/InledGroup%2Fbastion.browser/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32343808,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-26T23:26:28.701Z","status":"online","status_checked_at":"2026-04-27T02:00:06.769Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-04-27T16:10:02.294Z","updated_at":"2026-04-27T16:10:04.485Z","avatar_url":"https://github.com/InledGroup.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Bastion Browser: Remote Isolation Engine\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"client/public/bastion.png\" alt=\"Bastion Browser Logo\" width=\"200\"\u003e\n\u003c/p\u003e\n\n[![License: GNU GPLv3.0](https://img.shields.io/badge/License-GNU-yellow.svg)](https://opensource.org/licenses/GPL-3.0)\n[![Docker](https://img.shields.io/badge/Docker-Ready-blue.svg)](https://www.docker.com/)\n[![React](https://img.shields.io/badge/React-18-61dafb.svg)](https://reactjs.org/)\n[![Node.js](https://img.shields.io/badge/Node.js-Backend-339933.svg)](https://nodejs.org/)\n\n\u003e [!WARNING]\n\u003e **Work in Progress / Early Beta**  \n\u003e This project is currently under construction and in a very early beta stage. Expect frequent updates, potential bugs, and incomplete features.\n\n\n**Bastion Browser** is an advanced **Remote Browser Isolation (RBI)** solution designed to provide an impenetrable security layer between the user and threats from the public web. By running browsing sessions in an isolated container on the server and streaming only an interactive visual feed, Bastion eliminates the risk of malicious code execution directly on the local machine.\n\n---\n\n## 🚀 Core Functionality\n\nBastion transforms web browsing into a secure, interactive service:\n\n- **Real-Time Interactive Browsing**: Full keyboard and mouse control over a remote Chromium instance.\n- **High-Speed Screencast**: Smooth transmission via optimized WebSockets.\n- **Tab Management**: Dynamic multi-tab support within a sealed environment.\n- **Search Engine Integration**: Quick access to Startpage, Brave, and Google with enhanced privacy.\n- **Secure Downloads**: Staging system that intercepts files on the server before final local transfer.\n- **Secure Uploads**: Support for uploading files from the local machine to the remote browser session.\n\n---\n\n## 🛡️ Integrated Security (Iron Bastion)\n\nSecurity is not an option; it is the architecture upon which Bastion is built:\n\n### 1. Session Isolation (UUID)\nEach user connection generates a completely unique and separate browser context (Incognito Context). There is no data persistence between sessions and no information leakage between different users.\n\n### 2. Anti-SSRF Protection (Server-Side Request Forgery)\nA dynamic validation engine analyzes every URL before navigation. It proactively blocks access to:\n- Internal networks (127.0.0.1, 192.168.x.x, etc.)\n- Cloud provider metadata (AWS, Google Cloud, Azure).\n- Private ports and services within the server ecosystem.\n\n### 3. API Key Authentication\nMandatory access control layer for all WSS tunnels and API endpoints. Only clients possessing the secret key can interact with the navigation engine.\n\n### 4. End-to-End Encryption\nAll traffic, from mouse movements to browser frames, travels through **HTTPS/WSS** tunnels protected by TLS certificates.\n\n### 5. Resource and DoS Control\nStrict limitation of:\n- Total concurrent sessions.\n- Maximum number of tabs per session.\n- Timeouts for downloads and connections.\n\n---\n\n## 🛠️ Technological Stack\n\n- **Frontend**: React 18, Vite, TypeScript, Lucide Icons.\n- **Backend**: Node.js, Express, WebSocket (ws).\n- **Browser Control**: Puppeteer Extra with **Stealth Plugin** (to avoid bot detection).\n- **Security**: Helmet.js, Crypto Encryption, SSRF URL Validation.\n- **Containerization**: Docker \u0026 Docker Compose.\n\n---\n\n## 📦 Installation \u0026 Deployment\n\n### 🏠 CasaOS Deployment (One-liner)\nIf you are using CasaOS, you can install Bastion Browser and have it show up in your dashboard with a single command:\n```bash\ngit clone https://github.com/InledGroup/bastion.browser.git \u0026\u0026 cd bastion.browser \u0026\u0026  docker compose up -d --build\n```\n\n### 🐳 Docker Compose (Standard)\n1. **Clone the repository:**\n   ```bash\n   git clone https://github.com/InledGroup/bastion.browser.git\n   cd bastion.browser\n   ```\n2. **Configure environment (Optional):**\n   Edit the `.env` file to set your `API_KEY` and `PORT`.\n3. **Start the application:**\n   ```bash\n    docker compose up -d --build\n   ```\n\nThe service will be available at `https://localhost:112` (or your configured port).\n\n### 🛠️ Manual Build (Local)\n```bash\n# Clone the repository\ngit clone https://github.com/InledGroup/bastion.browser.git\ncd bastion.browser\n\n# Build and run using the helper script\nchmod +x build_and_run.sh\n./build_and_run.sh\n```\n\n---\n\n## 🗺️ Project Orientation\n\nBastion is oriented towards:\n- **Threat Research**: Analyzing suspicious URLs without risk to the local machine.\n- **Extreme Privacy**: Browsing from a clean server IP with no local traces.\n- **Corporate Environments**: Providing a secure gateway for uncategorized websites.\n\n---\n\n## ⚖️ Disclaimer\n\nThis software is designed for educational and defensive security purposes. Use of this tool for malicious activities is strictly prohibited. The author is not responsible for any misuse of the technology presented here.\nIf you decide to use this software for illegal purposes, it is your problem.\nFurthermore, the author is not responsible for any data loss that may occur through the use of this tool or security issues that may arise from its use. You are responsible for auditing whether this tool and its code fit your needs and the threat you wish to mitigate.\n\n---\n\u003cp align=\"center\"\u003eDeveloped with ❤️ by \u003ca href=\"https://jaimegh.com\"\u003eJaimeGH\u003c/a\u003e, from \u003ca href=\"https://inled.es\"\u003eInled Group\u003c/a\u003e\u003c/p\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finledgroup%2Fbastion.browser","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Finledgroup%2Fbastion.browser","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finledgroup%2Fbastion.browser/lists"}