Handing Real Logins to Headless AI Agents: Building the Lightpanda Session Bridge

Описание и применение

Агенты ИИ могут безопасно работать с веб‑дашбордами, используя мост сессий Lightpanda, который передаёт только временные, ограниченные куки, не раскрывая пароли.

Задача

AI agents need to interact with modern web dashboards that use OAuth, SSO, passkeys, and 2FA, but headless browsers cannot perform these authentication rituals, forcing insecure credential handling.

Результат

Agents can securely interact with authenticated web dashboards without exposing passwords, reducing credential leakage risk and improving workflow isolation.

Рабочий процесс

• 1. User logs into target site using native browser authentication (passkey, OAuth, 2FA).
• 2. User clicks the Lightpanda Session Bridge extension’s Sync button.
• 3. Extension extracts and normalizes cookies for the active domain and posts them to the local relay at 127.0.0.1:8765 with a secure token.
• 4. The relay validates origin, normalizes cookie format, and forwards them over CDP WebSocket to a Lightpanda headless instance running in WSL2.
• 5. The AI agent connects to Lightpanda via the Python SDK, attaches to the authenticated page, and evaluates JavaScript to perform its task.
• 6. Agent completes its work without ever seeing the user’s credentials.
• 7. User can revoke the session by logging out of the main browser, instantly invalidating the headless session.

Доказательства

Zero credentials typed, zero secrets exposed to LLMs.

Источник

The relay never logs a cookie value.

Источник

Backed by 9 automated security test suites, validating private IP rejections, CDP payload structures, and token enforcement.

Источник