Chrome DevTools Protocol

A command goes in and an answer comes back over a single socket. Navigation, clicks, typing, cookies, screenshots and page script all travel the same way.

1. 1

   One socket per running browser

   The browser publishes its own address once it has started listening, and a driver reads it from there.

2. 2

   Commands are grouped by area

   Each area covers one part of the browser and every command names the area it belongs to.

3. 3

   Streams are asked for

   A driver receives events only after it switches an area on, and switching one on changes the browser.

These are read in the browser you are reading this in. The automation flag is the first line of almost every bot check.

An open debugging port asks for no password. Anything running on the same machine under the same account can drive the browser through it.

• An application wide address reaches everything

  One endpoint for the whole program means a driver can steer the manager window and not only a profile.

• It opens only where it is needed

  The main engine gives every profile its own entry point, so the application wide port stays shut.

• It lives only while a window does

  The entry point goes away with the profile it belongs to, and an address kept from an earlier run points at nothing.

Switching on the script area makes the browser install hooks that page script can notice. Several well known bot checks do nothing but look for those.

That area is never switched on here. The other two come up only for the work that needs them and leave nothing a page can read.

• Script runs with the area off

  Evaluating script, navigating and sending input all work without switching anything on.

• Readiness is asked for by hand

  The page is asked about its own loading state instead of subscribing to a stream of lifecycle events.

• Only one of the two goes down again

  The lifecycle area is switched off as soon as the capture ends. The request area comes up with the first wait step and stays up until the profile closes.

Opening a debugging port makes Chromium report that the browser is being automated, and that single value ends a check before the fingerprint is looked at.

A launch switch clears it, and the value is read back from a real page in the real engine rather than assumed.

• WebDriver

  A different protocol with a server of its own, and a browser driven through it says so in the same flag.

• An extension

  An extension lives inside the page world and reaches only what the browser hands it.

• A local interface

  The local interface is the door opened for your own scripts. This protocol is the channel behind that door.