DevTools inspector redirect broken with USE_SSL=true (ws= param keeps wss:// scheme)

Author: marlien-gonsalesCreated Aug 17, 2026Updated Aug 18, 2026

Self-hosted steel-browser behind a TLS-terminating proxy, with DOMAIN= and USE_SSL=true.

The inspector endpoint redirects to devtools_app.html with a ws= param built in src/modules/cdp/cdp.routes.ts:

`?ws=${server.cdpService.getDebuggerWsUrl(request.query.pageId).replace("ws:", "")}`

With USE_SSL=false this strips ws: from ws://host/... → //host/... (scheme-relative) and the DevTools frontend works.

With USE_SSL=true the URL is wss://host/... and .replace("ws:", "") no-ops (literal ws: never matches wss:), so the frontend receives ws=wss://host/... and tries to connect to the malformed ws://wss//host/... which is then CSP-blocked:

Connecting to 'ws://wss//<host>/devtools/page/<id>' violates CSP directive connect-src ...

Suggested one-word-class fix: .replace(/^wss?:/, "") (strip the scheme regardless of SSL mode).

Repro: run self-hosted with DOMAIN + USE_SSL=true, open a session, open the DevTools/inspector view → blank iframe + the CSP console error above. Main live view (/v1/sessions/debug, cast) is unaffected.