Security

The page is served from droid.devpier.dev, but the emulator and the gateway run on your Mac. Any web page you open could try to connect to a program on your Mac, so the gateway checks every connection.

Loopback only

The gateway listens only on 127.0.0.1. It does not accept connections from your local network or the internet. Other computers cannot reach it.

Origin allow-list

Browsers send an Origin header when a page opens a WebSocket. The gateway accepts only these origins:

• https://droid.devpier.dev
• http://127.0.0.1:<port>
• http://localhost:<port>

A connection with any other origin, or with no origin, is closed with code 4003. A page on another site cannot control your emulator, even if it guesses the port.

Launch token

• Each time the gateway starts, it creates a new random token: 32 random bytes, encoded as a 43-character base64url string.
• The gateway opens the page with the port and token after #: https://droid.devpier.dev/app/#port=<port>&token=<token>. Browsers do not send the part after # to the web server, so the token never reaches droid.devpier.dev.
• The page saves the port and token in the browser’s local storage, so you can reload the page, and removes them from the address bar.
• The first message on every connection must carry the token. If it is wrong, the gateway replies with a bad-token error and closes the connection with code 4001.
• When the gateway restarts, the old token stops working. Open the new link it prints.

The website does not connect to your Mac

Chrome’s local network permission and the gateway’s Origin check both work per site, not per path. So the documentation pages share the permission with the emulator page at /app/. To limit what that means:

• Only the emulator page at /app/ connects to the gateway. The home page and these docs never do, so reading them does not trigger the permission prompt.
• The site loads no third-party scripts, styles, fonts or media. Everything is served from droid.devpier.dev.
• The token is a second check: a page on droid.devpier.dev without the token cannot use the gateway.

Installing software

The gateway never installs Android SDK packages or creates devices without asking. It asks [y/N] in Terminal, and the default is no. You accept the Android SDK licenses yourself.

Connection close codes

Code	Meaning
4000	The first message was not hello.
4001	Wrong token.
4002	The page and the gateway use different protocol versions.
4003	Origin not allowed.

Reporting a problem

Open an issue at github.com/twosugar/android-emu-web.