microlinkhq / browserless / 41664926997 / 9

77%

master: 77%

push

github

fix(browserless): keep proxy credentials out of Chromium (#1016)

* fix(browserless): keep proxy credentials out of Chromium

A context's proxy credentials used to reach Chromium through
page.authenticate. Puppeteer answers every auth challenge with those
credentials, whether the proxy or the site asked for them. Once Chromium
has cached the proxy login, any 401 Basic from the site (a subresource, a
navigation, the favicon) arrived with the proxy's username and password.

createContext now accepts a proxyServer that carries credentials. It
starts a proxy-chain forwarder on loopback that adds the credentials
upstream, gives Chromium the forwarder, and closes it in destroyContext,
including when the context failed to open. A proxyServer without
credentials is passed through unchanged, so existing callers are not
affected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(browserless): lock that closing a forwarder does not wait for an open tunnel

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs(browserless): proxy credentials go in proxyServer, not authenticate

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(browserless): close forwarders with the browser and keep credentials out of their errors

browserless.close() now closes the forwarder of every context that was
never destroyed, including one still starting. A context created after
close() starts none. An error from starting a forwarder no longer carries
the proxy username or password.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(browserless): lock that a destroyed context leaves the forwarder set

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(browserless): lock a readable forwarder error for a username-only proxy

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(browserless): forward scheme-less proxies and close only own forwarders

- 'user:pass@host:port' defaults to http like Chromium does, so it i... (continued)

192 of 260 branches covered (73.85%)

Branch coverage included in aggregate %.

788 of 928 relevant lines covered (84.91%)

32.96 hits per line