Selenium Grid – Security & Authentication

1. Background

At Verisoft, we use a self-hosted Selenium Grid, deployed using Docker Compose, to execute automated tests remotely.

Previously, our Selenium Grid was publicly accessible over the internet without authentication.

This created a security vulnerability that allowed unauthorized users to access the Grid and create browser sessions.

Security incident: An unauthorized party gained control of our Selenium Grid, demonstrating the risk of exposing the service without protection.

To prevent further unauthorized access, we implemented Selenium Grid's built-in HTTP Basic Authentication.

2. Our Solution – HTTP Basic Authentication

Selenium Grid 4 supports built-in HTTP Basic Authentication, allowing us to require a username and password for accessing the Grid.

This protects:

• Grid UI – Users must authenticate before accessing the dashboard.
• WebDriver API – Automated tests must authenticate before creating browser sessions.

Docker Compose Configuration

Authentication is configured on the Selenium Hub using environment variables:

services:
  selenium-hub:
    image: selenium/hub:4.51.0-20261010
    environment:
      SE_ROUTER_USERNAME: ${SELENIUM_GRID_USER}
      SE_ROUTER_PASSWORD: ${SELENIUM_GRID_PASSWORD}

Credentials are managed separately through environment variables (saved in .env) and must not be committed to source control.

Our Grid is available at:

https://grid.verisoft.io/

HTTPS encrypts the connection, protecting credentials during transmission.

3. Connecting from Java (Selenium WebDriver)

Automated tests must now provide credentials when creating a RemoteWebDriver.

Example using Selenium 4:

import org.openqa.selenium.WebDriver;
import org.openqa.selenium.chrome.ChromeOptions;
import org.openqa.selenium.remote.RemoteWebDriver;
import org.openqa.selenium.remote.http.ClientConfig;
import org.openqa.selenium.remote.HttpCommandExecutor;
import org.openqa.selenium.UsernameAndPassword;

import java.net.URL;

public class GridExample {

    public static void main(String[] args) throws Exception {

        URL gridUrl = new URL("https://grid.verisoft.io/");

        ClientConfig config = ClientConfig.defaultConfig()
                .baseUrl(gridUrl)
                .authenticateAs(new UsernameAndPassword(
                        System.getenv("SELENIUM_GRID_USER"),
                        System.getenv("SELENIUM_GRID_PASSWORD")
                ));

        WebDriver driver = new RemoteWebDriver(
                new HttpCommandExecutor(config),
                new ChromeOptions()
        );

        try {
            driver.get("https://example.com");
            System.out.println(driver.getTitle());
        } finally {
            driver.quit();
        }
    }
}

Important: Credentials should be stored in Jenkins Credentials or another secure secrets manager, never hardcoded in automation projects.

4. Security Verification

After enabling authentication, we verified the following:

Authenticated WebDriver session creation was successfully tested using Python.

5. Additional Security Considerations

Basic Authentication prevents unauthorized requests when properly enforced, but it should not be treated as a complete security solution.

For additional protection, we recommend restricting direct access to Grid ports, allowing only trusted Jenkins agents and developers, and periodically rotating credentials.

References:

• Selenium Grid Documentation
• Selenium Grid Configuration
• Docker Selenium