What Happened
In pestphp/pest-plugin-browser (5.x), both ignoreHTTPSErrors and bypassCSP get set in the client, but neither reaches a Playwright API that takes them. So neither is actually on.
Client::connectTo() puts them in the websocket launch-options query. The server runs that through filterLaunchOptions(), which is a whitelist: channel, args, ignoreAllDefaultArgs, ignoreDefaultArgs, timeout, headless, proxy, chromiumSandbox, firefoxUserPrefs, slowMo, executablePath, downloadsPath, artifactsDir. Neither one's in there, so headless makes it through and the other two get dropped.
BrowserFactory::launch() sends them as BrowserType.launch params instead. scheme.BrowserTypeLaunchParams doesn't have either, and tObject builds its result by walking the schema's keys — so anything it doesn't know about just disappears, no error. (ignoreHttpsErrors there has a lowercase t as well, where Playwright writes ignoreHTTPSErrors. Doesn't matter, the key gets dropped either way.)
The place Playwright does take them is Browser.newContext; scheme.BrowserNewContextParams has both. The plugin's only newContext() call sits in PendingAwaitablePage::buildAwaitablePage() and passes locale, timezoneId, colorScheme, the device context and the user's options. Neither of these.
Fix is probably just moving both into the newContext() options and dropping them from the two launch paths.
How to Reproduce
I should be straight about this: I found it by reading the code on both sides, not by hitting it in a suite. So here's how to check the claim rather than a failing test.
In the plugin, grep -rn 'ignoreHTTPSErrors\|ignoreHttpsErrors\|bypassCSP' src/ returns exactly three lines — two in Client.php, one in BrowserFactory.php, and nothing in the newContext() call.
In node_modules/playwright-core/lib/coreBundle.js, filterLaunchOptions() shows the whitelist, scheme.BrowserTypeLaunchParams shows neither key, scheme.BrowserNewContextParams shows both, and tObject shows unknown keys being dropped without an error.
What I'd expect at runtime, though I haven't run it: visit() against an HTTPS host whose certificate the browser doesn't trust should die on the certificate, which is the thing ignoreHTTPSErrors is there to prevent. Nothing in the plugin's suite would catch it either way — the one HTTPS test hits https://example.com, which has a valid cert.
For bypassCSP I couldn't work out what it would break at all. Playwright pushes addInitScript and evaluate through CDP, and page CSP doesn't touch those. It's set, it doesn't arrive, and I don't know whether anything cares.
Pest Version
pestphp/pest-plugin-browser at 5.x (composer requires pestphp/pest: ^5.0.4), with the pinned playwright: ^1.62.1. Verified against playwright-core@1.62.1 sources.
PHP Version
8.4+ (the plugin requires ^8.4); this is protocol-level and doesn't depend on the PHP version.
Operation System
Not platform-specific — the options are dropped by the Playwright server's own option filter and protocol validator, so it happens the same everywhere.
What Happened
In
pestphp/pest-plugin-browser(5.x), bothignoreHTTPSErrorsandbypassCSPget set in the client, but neither reaches a Playwright API that takes them. So neither is actually on.Client::connectTo()puts them in the websocketlaunch-optionsquery. The server runs that throughfilterLaunchOptions(), which is a whitelist:channel, args, ignoreAllDefaultArgs, ignoreDefaultArgs, timeout, headless, proxy, chromiumSandbox, firefoxUserPrefs, slowMo, executablePath, downloadsPath, artifactsDir. Neither one's in there, soheadlessmakes it through and the other two get dropped.BrowserFactory::launch()sends them asBrowserType.launchparams instead.scheme.BrowserTypeLaunchParamsdoesn't have either, andtObjectbuilds its result by walking the schema's keys — so anything it doesn't know about just disappears, no error. (ignoreHttpsErrorsthere has a lowercasetas well, where Playwright writesignoreHTTPSErrors. Doesn't matter, the key gets dropped either way.)The place Playwright does take them is
Browser.newContext;scheme.BrowserNewContextParamshas both. The plugin's onlynewContext()call sits inPendingAwaitablePage::buildAwaitablePage()and passeslocale,timezoneId,colorScheme, the device context and the user's options. Neither of these.Fix is probably just moving both into the
newContext()options and dropping them from the two launch paths.How to Reproduce
I should be straight about this: I found it by reading the code on both sides, not by hitting it in a suite. So here's how to check the claim rather than a failing test.
In the plugin,
grep -rn 'ignoreHTTPSErrors\|ignoreHttpsErrors\|bypassCSP' src/returns exactly three lines — two inClient.php, one inBrowserFactory.php, and nothing in thenewContext()call.In
node_modules/playwright-core/lib/coreBundle.js,filterLaunchOptions()shows the whitelist,scheme.BrowserTypeLaunchParamsshows neither key,scheme.BrowserNewContextParamsshows both, andtObjectshows unknown keys being dropped without an error.What I'd expect at runtime, though I haven't run it:
visit()against an HTTPS host whose certificate the browser doesn't trust should die on the certificate, which is the thingignoreHTTPSErrorsis there to prevent. Nothing in the plugin's suite would catch it either way — the one HTTPS test hitshttps://example.com, which has a valid cert.For
bypassCSPI couldn't work out what it would break at all. Playwright pushesaddInitScriptandevaluatethrough CDP, and page CSP doesn't touch those. It's set, it doesn't arrive, and I don't know whether anything cares.Pest Version
pestphp/pest-plugin-browserat5.x(composer requirespestphp/pest: ^5.0.4), with the pinnedplaywright: ^1.62.1. Verified againstplaywright-core@1.62.1sources.PHP Version
8.4+ (the plugin requires
^8.4); this is protocol-level and doesn't depend on the PHP version.Operation System
Not platform-specific — the options are dropped by the Playwright server's own option filter and protocol validator, so it happens the same everywhere.