chore: wire CDP Fetch runtime when proxy is disabled by cacieprins · Pull Request #34276 · cypress-io/cypress

cacieprins · 2026-07-10T19:05:21Z

Closes CDP transport for HttpIntercept #34271

Additional details

Wires the CDP Fetch network runtime when the MITM proxy is disabled (CYPRESS_INTERNAL_DISABLE_PROXY), so AUT request/response traffic is surfaced through CDP Fetch instead of the Node proxy.

Adds ServerBase.createCdpFetchNetworkRuntime and hooks it from Chrome/Electron via onPageCriClientReady when the proxy is disabled
Slims createCdpFetchRuntime to a lightweight HttpIntercept + CdpFetchTransport path (no legacy NetworkProxy pipeline)
Skips proxy-detection / non-proxied clientRoute guards when the proxy is disabled, since path-only hits to the Cypress server are expected under CDP Fetch
Passes isAUTFrame into the CDP Fetch transport for AUT-frame correlation

Depends on the CDP Fetch transport from #34222.

Steps to test

Run with proxy disabled (CYPRESS_INTERNAL_DISABLE_PROXY=1) against a Chromium browser.
Confirm AUT traffic is paused/continued via CDP Fetch and reaches HttpIntercept.
Confirm Cypress client assets still load (no false "launched outside Cypress" / non-proxied clientRoute failures).
Spot-check that proxy-enabled mode is unchanged.

How has the user experience changed?

No change for default (proxy-enabled) runs. Enables the proxy-disabled CDP Fetch path for the HTTP/2 interception migration.

PR Tasks

Is there an associated issue with maintainer approval for PR submission?
Have tests been added/updated?
[na] Has a PR for user-facing changes been opened in cypress-documentation?
[na] Have API changes been updated in the type definitions?

Made with Cursor

cypress · 2026-07-10T19:35:44Z

cypress Run #72376

Run Properties: Passed #72376 • a880bfb9a7: fix: harden CDP Fetch runtime teardown and scope the AUT-frame header to documen...

Project	`cypress`
Branch Review	`cacie/34271/cdp-runtime-when-proxy-disabled`
Run status	`Passed #72376`
Run duration	`08m 03s`
Commit	`a880bfb9a7: fix: harden CDP Fetch runtime teardown and scope the AUT-frame header to documen...`
Committer	`Bill Glesias`
View all properties for this run ↗︎

Test results
Failures	`0`
Flaky	`0`
Pending	`3`
Skipped	`0`
Passing	`0`
View all changes introduced in this branch ↗︎

Warning

No Report: Something went wrong and we could not generate a report for the Application Quality products.

Co-authored-by: Cursor <cursoragent@cursor.com>

Merging develop reintroduced CreateProxyRuntimeDeps on createCdpFetchRuntime, which broke the proxy-disabled call site that only passes client/isAUTFrame. Co-authored-by: Cursor <cursoragent@cursor.com>

Reset clears in-flight state without disabling Fetch, and continueRequest headers always include X-Cypress-Is-AUT-Frame when the request is AUT-frame. Co-authored-by: Cursor <cursoragent@cursor.com>

…ions Cfg.clientRoute is optional because RuntimeConfigOptions extends Partial<RuntimeServerConfigOptions>. Reuse InternalRouteConfig for CDP Fetch runtime deps so server-base can pass _openConfig without TS2322. Co-authored-by: Cursor <cursoragent@cursor.com>

…bled startWebsockets left options.getRenderedHTMLOrigins undefined without a networkProxy, but the driver requests the map in its before-each via reset:cached:test:state, crashing socket-base and skipping all tests. Fall back to an empty map until CDP-based injection tracks origins. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…header The serve-internal-routes loopback request line is path-only, so Express consumers that derive the request origin from req.proxiedUrl (e.g. the spec-bridge iframe controller) saw a path instead of an origin. Send the browser's original absolute URL as the loopback header value and have setProxiedUrl restore it as proxiedUrl for trusted loopbacks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

… to documents - Swallow rejections when stopping the previous CDP Fetch runtime so a dead page client (spec change, relaunch) cannot fail the next launch - Only inject X-Cypress-Is-AUT-Frame on document requests, matching the other automation layers, and dedupe it on redirect re-pauses so it never leaks to origin servers on AUT subresource traffic - Share the AUT_FRAME_HEADER constant across the CDP/BiDi/WebKit layers - Make CdpFetchTransport.reset() synchronous and document that `hosts` and `blockHosts` are not enforced in proxy-disabled mode Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit a880bfb. Configure here.}

cursor · 2026-07-14T17:38:39Z

+      headers.push({
+        name: AUT_FRAME_HEADER,
+        value: 'true',
+      })


AUT header leaks upstream without proxy

Medium Severity

With the MITM proxy disabled, CDP Fetch adds X-Cypress-Is-AUT-Frame on AUT document Fetch.continueRequest calls. That traffic no longer passes through NetworkProxy request middleware, which previously removed the header before upstream requests. External AUT navigations can therefore send this internal Cypress marker to the application origin.

^{Reviewed by Cursor Bugbot for commit a880bfb. Configure here.}

AtofStryker · 2026-07-15T12:20:05Z

I put together a reference commit for something I noticed in review: 1ec7f9b.

setProxiedUrl now trusts the x-cypress-internal-loopback header as the authoritative proxiedUrl, and it runs on every inbound request — including in normal proxy-enabled mode. AUT content can send that header itself (same-origin fetch allows custom headers), so a script in the app under test could control req.proxiedUrl, which feeds the iframes controller's origin / document.domain decisions.

The commit signs the header with a per-process random token (same idea as the file-server token) and only honors it when the token matches. Tests updated, plus negative cases for the spoofed header. check-ts, lint, and the touched suites pass with it applied on this branch.

Might be overkill for an initial pass of an internal flag — fine as a fast-follow too. Sharing so the fix is concrete either way.

AtofStryker · 2026-07-15T13:09:20Z

    request: deps.request,
  }))

-  networkInterception.use(networkProxy.http.createLegacyProxyPipeline(syntheticCodec))


I see the description calls this out ("Slims createCdpFetchRuntime to a lightweight HttpIntercept + CdpFetchTransport path (no legacy NetworkProxy pipeline)"), but it's unclear to me why we're removing the legacy NetworkProxy pipeline here. #34250 just wired it up as intercept middleware, and dropping it from the CDP runtime means none of the legacy request/response stages run in proxy-disabled mode.

Is this intentional as a starting point we build around (porting the middleware onto HttpIntercept piece by piece), rather than re-mounting the legacy pipeline over the synthetic codec?

If it is, then we likely need to address #34276 (comment) — with the legacy pipeline gone, nothing strips X-Cypress-Is-AUT-Frame, so the header the transport injects is sent along to the origin server when it shouldn't be.

cursor Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread packages/server/lib/browsers/cdp-protocol/cdp-fetch-transport.ts Outdated

Comment thread packages/server/lib/server-base.ts Outdated

cursor Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread packages/server/lib/server-base.ts

AtofStryker self-assigned this Jul 14, 2026

cacieprins and others added 4 commits July 14, 2026 10:16

chore: wire CDP Fetch runtime when proxy is disabled

0b79933

Co-authored-by: Cursor <cursoragent@cursor.com>

fix: restore lightweight CDP Fetch runtime for proxy-disabled mode

0b95a9d

Merging develop reintroduced CreateProxyRuntimeDeps on createCdpFetchRuntime, which broke the proxy-disabled call site that only passes client/isAUTFrame. Co-authored-by: Cursor <cursoragent@cursor.com>

Disable proxy detection when proxy is disabled

ec35f65

fix: keep CDP Fetch alive across tests and preserve AUT frame header

b92e23c

Reset clears in-flight state without disabling Fetch, and continueRequest headers always include X-Cypress-Is-AUT-Frame when the request is AUT-frame. Co-authored-by: Cursor <cursoragent@cursor.com>

AtofStryker force-pushed the cacie/34271/cdp-runtime-when-proxy-disabled branch from 00ca773 to 72d49a8 Compare July 14, 2026 14:36

AtofStryker force-pushed the cacie/34271/cdp-runtime-when-proxy-disabled branch from 703bf54 to 08027c5 Compare July 14, 2026 15:39

AtofStryker assigned cacieprins Jul 14, 2026

AtofStryker requested review from a team, AtofStryker and mschile July 14, 2026 15:51

AtofStryker and others added 2 commits July 14, 2026 13:26

cursor Bot reviewed Jul 14, 2026

View reviewed changes

AtofStryker reviewed Jul 15, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: wire CDP Fetch runtime when proxy is disabled#34276

chore: wire CDP Fetch runtime when proxy is disabled#34276
cacieprins wants to merge 8 commits into
developfrom
cacie/34271/cdp-runtime-when-proxy-disabled

cacieprins commented Jul 10, 2026

Uh oh!

Uh oh!

Uh oh!

cypress Bot commented Jul 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jul 14, 2026

Uh oh!

AtofStryker commented Jul 15, 2026

Uh oh!

AtofStryker Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

cacieprins commented Jul 10, 2026

Additional details

Steps to test

How has the user experience changed?

PR Tasks

Uh oh!

Uh oh!

Uh oh!

cypress Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

cypress Run #72376

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 14, 2026

Choose a reason for hiding this comment

AUT header leaks upstream without proxy

Uh oh!

AtofStryker commented Jul 15, 2026

Uh oh!

AtofStryker Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cypress Bot commented Jul 10, 2026 •

edited

Loading