Chrome DevTools not able to connect to Node inspect since 7.5.0

[owenallenaz]

• Version: 7.5.0, 7.6.0
• Platform: Linux nodeServer 2.6.32-573.el6.x86_64 deps: update openssl to 1.0.1j #1 SMP Thu Jul 23 15:44:03 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux (VM) on Windows 10
• Subsystem: Debugger

When I run a script with --inspect, I am no longer able to connect via Chrome DevTools since Node 7.5.0. When I attempt to connect I get "Debugging connection was closed. Reason: WebSocket disconnected Reconnect when ready by reopening DevTools" Clicking reconnect DevTools does not reconnect."

Simple script:

> node --inspect=8080 -e "setTimeout(function() { console.log('yes'); }, 30000)"
Debugger listening on port 8080.
Warning: This is an experimental feature and could change at any time.
To start debugging, open the following URL in Chrome:
    chrome-devtools://devtools/bundled/inspector.html?experiments=true&v8only=true&ws=127.0.0.1:8080/e7cadd27-e1d6-42d3-8c53-c407dd543ec5

If I perform those steps on Node 7.4.0, it works. If I do the same steps in Node 7.5.0 or 7.6.0, the URL will no longer connect. I have the same results if I utilize Chrome 56.0.2924.87 or Canary 58.0.3025.0 on Windows.

I've recorded a screencast showing the steps to recreate and it functioning on 7.4.0 and failing on 7.6.0: https://www.screencast.com/t/vFyha8YI5

[mscdex]

/cc @nodejs/v8-inspector

[brantw]

I've also seen this. Debugging seems to work locally but not remotely. This also affects --debug as well as --inspect. For example, in node 7.6.0 I can node debug on the host running node, but cannot node debug server_name:5858 from another host. If I downgrade to 7.4.0 I am able to connect to the debugger remotely.

[bnoordhuis]

I suspect #9691 is responsible. It harmonizes option parsing with the old debugger but it presumably changed the default from 0.0.0.0 to 127.0.0.1 (although I'm 80% sure that was the default for --debug already.)

I'd say it's a good thing, security-wise. You can opt-out with --debug=0.0.0.0:5858 or --inspect=0.0.0.0:9229.

[sam-github]

Sounds like the debug port is bound to localhost by default now, since opening it to remote connections allows remote attackers unfettered access, but I don't see signs of this in the changelog.

But there should be a way to change the default if its explicitly wanted.

@ofrobots, do you know anything about this?

[eugeneo]

@sam-github
As @bnoordhuis pointed out, you can specify an IP address to listen on. Inspector is still an "experimental feature" so I did not think that this bugfix needed to be reflected in a change list...

[sam-github]

My comments and Ben's crossed on the wire.

It was an unexpected change in how node behaves, it should have been documented. Experimental doesn't mean "we don't tell you when we changed it, post a github issue if you'd like to know more". I don't think it means "we reserve the right to make breaking changes in minor updates" either. cc: @Trott

I think the change to default to localhost is a good one, but I'm not sure it should have happened before 8.x (though security fixes are allowed to majors even when breaking, the CTC has the power to give them special exemptions).

Btw, something is wrong here: https://github.com/nodejs/node/pull/9691/files shows zero changes in the diff, and no commits, but also says its merged. I haven't seen that before in github, it sure makes it hard to review the PR retroactively to see what was merged.

@eugeneo any idea what is going on with the PR?

[eugeneo]

I am not sure what had happened to the pull request display - the actual commit can be seen here - f9aadfb

But it looks like the change is really this one - #10878

[brantw]

I can confirm --debug=0.0.0.0:5858 does allow for remote debugging again in 7.6.0. I see why the change is beneficial from a security standpoint, but I wish there had been some docs for this change. It would have saved several cycles trying to track down why remote debugging stopped working.

[sam-github]

@eugeneo can you PR some docs for the current state, something saying what address is listened on by default?

[owenallenaz]

While the --debug pathway might work, I'm not sure if there is a way to get the --inspect pathway as it stands on 7.60. I've tested a couple different variants. Looking at the code in the commit, it was altered to use host pretty much everywhere, but if you look at the original code, sometimes it was 0.0.0.0 and othertimes it was 127.0.0.1. Well with the host var it's using the same value everywhere, even though previously it was 2 distinct values. In example the URL that was spit out always contained 127.0.0.1 but then the there was the line for uv_ip4_addr("0.0.0.0", port_, &addr); which had 0.0.0.0 hardcoded.

I've tried variants of passing --inspect=0.0.0.0:8080 and using the URL given back as well as altering the url to contain 127.0.0.1:8080. I've also tried the opposite where I pass --inspect=127.0.0.1:8080 and use the URL or switch the url to be 0.0.0.0:8080. None of the attempts work. Some of them will "connect" but it's a weird state where I'm not able to actually get to any of the sources files, or interact with anything, but it's not giving me the disconnection error.

If someone has figured out a proper set of steps to use --inspect or --debug but connect via Chrome, I'm happy to use it as a work-around. For now we've just reverted back to 7.4.0 in the meantime.

[eugeneo]

I don't think remote debugging was tested enough. I am assigning this over to me - I see issues like json/list returning 0.0.0.0 as a host name (should be detected), I also expect other similar problems.

[oldrich-s]

I also experience issues with --inspect since version v7.5.0. When I install v7.4.0 the inspector works just fine. As soon as I install v7.5.0 or higher the inspector ends with empty sources, i.e. no files are present. Sometimes if I wait long enough the files in sources appear. Still I am not able to set any breakpoint in the files. To me something went really bad between version 7.4.0 and 7.5.0...

[sam-github]

It sounds like an unintended semver-major occurred between 7.4 .and 7.5, should it be reverted? @nodejs/ctc

Change was:

• default listen address for --inspect changed to localhost

Which is particularly problematic because there seems to be a (unrelated?) bug in the inspect option:

• using unspecified/INADDR_ANY listen address does not work