Skip to content

MCP browser_click on a submit button changes location.href without issuing any request #618

Description

@baderdean

Before you start

  • I searched existing issues and this is not a duplicate.
  • I tested against the latest release or main.
  • This is not a security vulnerability (those go through SECURITY.md, not a public issue).

obscura version or commit

6fa87e1

OS and architecture

Manjaro x86

How are you using obscura?

CLI (fetch / serve / scrape / mcp)

Affected area

CLI or MCP

Build variant

Render-enabled (official default archive or --features render)

Stealth mode

None

Reproduction

Minimal page served at http://127.0.0.1:8940/:

<!doctype html><meta charset="utf-8">
<form id="f" method="POST" action="/submitted">
  <input name="q" id="q" value="">
  <button type="submit" id="go">Envoyer</button>
</form>

The server logs every request it receives (method, path, body).

Path A — MCP (obscura --allow-private-network mcp, stdio)

browser_navigate {"url": "http://127.0.0.1:8940/"}
browser_fill     {"selector": "#q", "value": "hello"}
browser_click    {"selector": "#go"}      -> "Clicked '#go'"
browser_evaluate {"expression": "location.href"}
                                          -> "http://127.0.0.1:8940/submitted"

Requests seen by the server:

GET / body=''

That is all. No request for /submitted.

Path B — CDP (obscura --allow-private-network serve, Puppeteer connectOverCDP)

await page.goto('http://127.0.0.1:8940/');
await page.type('#q', 'hello');
await page.click('#go');

Requests seen by the server:

GET / body=''
POST /submitted body='q=hello'

Same binary, same page, same button. Only the driving layer differs.

Expected behavior

Clicking a submit button through the MCP tool browser_click reports success and updates
location.href to the form's action then a HTTP reques is sent.

Actual behavior

Clicking a submit button through the MCP tool browser_click reports success and updates
location.href to the form's action but no HTTP request is ever sent. The same click driven through CDP (Input.dispatchMouseEvent, e.g. Puppeteer's page.click()) correctly issues the POST.

The result is a silent false success: an agent sees Clicked '#go', reads back the expected URL, and concludes the form was submitted — while the server never received anything.

Rendering details

No response

Does headless Chrome behave the same?

No: headless Chrome renders or behaves correctly and obscura does not

Logs

INFO obscura_browser::page: script execution phase complete phase="script-execution-total" elapsed_ms=0 budget_ms=30000

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions