cyphr ~ transitloading
case studies
Headless Browser Automation
A RESTful API that puts programmatic control of a home router in reach, driving the router's own undocumented web UI through a headless browser when no official API exists to call instead.
Think of it like a tireless assistant filling out the router's own website • clicking the same menus a person would, just in under a second and without ever getting bored or logging you out.
The router only exposes a web admin panel • no public API. Reverse-engineering that undocumented interface meant keeping a session alive across requests, waiting out dynamic element loads, and getting past authentication dialogs without a human at the keyboard.
A persistent Puppeteer instance drives the panel directly: scripted DOM interactions replace clicking through menus, dialog handlers clear the popups that would otherwise stall a headless run, and encrypted session-based credentials keep the bot logged in across calls.
Consumer routers almost never ship one. The manufacturer's admin panel is the only interface, and it assumes a human with a mouse. Anything you want to automate • blacklisting a device, pulling connection stats, restarting an interface • means either flashing custom firmware or driving the panel the way a person would. Custom firmware voids warranties and breaks on model changes. Driving the panel is uglier but survives.
The panel expires sessions aggressively and re-authenticates through a modal rather than a redirect, which breaks most naive automation. The fix was a persistent browser context with an interceptor that detects the auth modal, re-submits stored credentials, and resumes the interrupted action • so a caller hitting the API never sees the difference between a warm session and a cold one.
Confirmation dialogs are invisible in headless mode but still block execution. Every destructive action needed a registered dialog handler before the click that triggers it, not after • a race condition that took longer to diagnose than it did to fix. That single ordering issue accounted for most of the early failure rate.
Storing router credentials in plaintext to automate a router is a bad trade. Credentials are encrypted at rest, decrypted only into the browser context, and never logged • including in error traces, which is where they usually leak.