[Regression]: http:// navigations are upgraded to https:// in Chromium 158, Chrome and Edge

Cerrado
  • ¿Algo no está bien?
#43,871 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
18/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
playwright, typescript
Área
testing-qa

Línea de trabajo

Start with the disabled-feature list in packages/playwright-core/src/server/chromium/chromiumSwitches.ts, which the issue says must add HttpsUpgrades and HttpsFirstBalancedModeAutoEnable, and check how #43455 reverted it. Then reproduce with the two scripts in the issue against the chromium and chrome channels. Done means both scripts reach the http:// URL with one request, and a regression test uses a public-looking host through --host-resolver-rules and passes headed and headless.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Last Good Version

1.64.1

First Bad Version

1.65.0-next. Two changes cause this:

  • #43455 stops disabling HttpsUpgrades. This affects Google Chrome and Microsoft Edge.
  • #43778 rolls to Chromium 158, which enables HTTPS-First balanced mode by default (HttpsFirstBalancedModeAutoEnable). This affects the bundled Chromium.
Steps to reproduce

Neither script needs an external site.

A host that has only http:

const http = require('http');
const { chromium } = require('playwright');

(async () => {
  const server = http.createServer((req, res) => res.end('served over http'));
  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
  const { port } = server.address();

  const browser = await chromium.launch({
    channel: 'chromium',
    args: [`--host-resolver-rules=MAP staging.example.org:80 127.0.0.1:${port},MAP staging.example.org:443 127.0.0.1:9`],
  });
  const page = await browser.newPage();
  await page.goto('http://staging.example.org/');
  console.log(page.url());
  await browser.close();
  server.close();
})();

A mock of an http:// URL:

const { chromium } = require('playwright');

(async () => {
  const browser = await chromium.launch({ channel: 'chrome' });
  const page = await browser.newPage();
  await page.route('http://app.example.org/', route => route.fulfill({ contentType: 'text/html', body: 'mocked' }));
  await page.goto('http://app.example.org/');
  console.log(await page.textContent('body'));
  await browser.close();
})();
Expected behavior

Playwright has disabled HTTPS upgrades since 2023 (#27605), so users expect the following:

  • page.goto('http://...') opens that URL, and page.url() and toHaveURL() report it.
  • page.route() for an http:// URL receives the request. The mocked host does not have to exist.
  • One navigation makes one navigation request. page.on('request'), HAR files and proxy logs show only that request.
  • A test gives the same result headless and headed. A developer can run --headed or --debug to investigate a failure from CI.
Actual behavior

The first script fails with page.goto: net::ERR_BLOCKED_BY_CLIENT at http://staging.example.org/. The error does not say that an HTTPS upgrade is the cause.

The second script fails with page.goto: net::ERR_NAME_NOT_RESOLVED at http://app.example.org/, because the request goes to https:// and the route does not match.

Scenario 1.64.1, Chrome 156 main, headless shell 158 main, Chromium 158 headed or chromium channel main, Chrome 156 or Edge 155
http:// host with no HTTPS Opens, 1 request Opens, 1 request net::ERR_BLOCKED_BY_CLIENT Opens, 3 requests
page.route() mock of an http:// URL Mocked Mocked net::ERR_NAME_NOT_RESOLVED net::ERR_NAME_NOT_RESOLVED
HTTP proxy that rejects CONNECT Opens, 1 request Opens, 1 request net::ERR_BLOCKED_BY_CLIENT Opens, 3 requests
Public host with HTTP and HTTPS Stays on http:// Stays on http:// Moves to https:// Moves to https://
http://localhost:<port> No change No change No change No change

Requests are navigation requests seen by page.on('request'). Tested on Linux with 8195aabcf, Chromium 158.0.8127.2, Chrome 156.0.8078.47 and Edge 155.0.4283.62.

Who is affected
  • Headed runs and new headless: --headed, --debug and channel: 'chromium'. The default headless shell does not have this feature, so a test can pass on CI and fail when a developer runs it headed.
  • Chrome and Edge: channel: 'chrome' and channel: 'msedge'. This includes Playwright MCP, which uses the chrome channel by default.
  • Common setups: staging hosts on port 80 with a public-looking name, tests that mock http:// URLs, and HTTP proxies.

Our test suite did not detect this, because localhost, private IP addresses and non-default ports are never upgraded. #43454 changed the proxy tests to use an exempt host name. Users would have to make the same change to their tests.

This does not affect only 1.65

Disabling HttpsUpgrades alone has no effect on Chromium 158. Playwright 1.64.1 with the Chromium 158 build (r1253) gives net::ERR_BLOCKED_BY_CLIENT in the same scenarios.

Chrome 158 is scheduled for early stable on 2026-11-04 and stable on 2026-11-17. I expect channel: 'chrome' and Playwright MCP to fail on these dates with every current Playwright version. I tested with the Chromium 158 build, because Chrome 158 stable is not available yet.

Users cannot safely work around this

The workaround from #43455 is args: ['--disable-features=HttpsUpgrades,HttpsFirstBalancedModeAutoEnable']. Chromium uses only the last --disable-features flag, so this replaces the list that Playwright passes, including ThirdPartyStoragePartitioning and PaintHolding. I confirmed this by passing the flag twice: only the last one had an effect. A safe workaround must repeat the full Playwright list, which changes between versions.

Recommendation for 1.65
Option http:// host with no HTTPS Route mock Proxy without CONNECT URL stays on http://
Ship main without a change Fails on Chromium 158 Fails Fails on Chromium 158 No
Disable only HttpsFirstBalancedModeAutoEnable Opens, 3 requests Fails Opens, 3 requests No
Disable both features Opens, 1 request Mocked Opens, 1 request Yes

Disabling both features gave the 1.64.1 result in every scenario above, on headed Chromium 158, the chromium channel, Chrome 156 and Edge 155. I tested this by passing the full default list plus the two features.

Recommended steps:

  1. Before we cut release-1.65, add HttpsUpgrades and HttpsFirstBalancedModeAutoEnable to disabledFeatures in packages/playwright-core/src/server/chromium/chromiumSwitches.ts. This reverts #43455.
  2. Add a regression test that navigates to a public-looking host name through --host-resolver-rules, because localhost is exempt. Run it on headed Chromium, the chromium channel and the chrome channel. Chromium can remove or rename these features, and this test will then fail on the next roll.
  3. Remove the HTTPS upgrade item from the 1.65 breaking changes.
  4. Release 1.65 before Chrome 158 stable on 2026-11-17, and consider a 1.64 patch release with the same change.
  5. If we want real browser behavior later, add it as an explicit option with its own announcement. It should not come as a side effect of a Chromium roll.
Lenguaje dominante
TypeScript
Estrellas
99.1k
Forks
6.8k
Merge medio
15 h 37 min
PR fusionados (30 d)
329

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de microsoft/playwright

Todos los issues de microsoft/playwright

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.