From e8db4a64cbf562e6ef2122a86a8c52d3bacb2903 Mon Sep 17 00:00:00 2001 From: Andrew Longosz Date: Wed, 9 Sep 2026 18:04:31 +0200 Subject: [PATCH] Treated CI web origins as secure contexts in browser tests Chrome reaches the site as http://web (http://varnish on Varnish setups). Neither is a secure context, so secure-only browser APIs such as crypto.randomUUID() do not exist there and code relying on them crashes before any scenario can exercise it. Chrome's own switch --unsafely-treat-insecure-origin-as-secure marks those two origins as trustworthy without changing the docker stack. Co-Authored-By: Claude Fable 5.1 --- behat_ibexa_oss.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/behat_ibexa_oss.php b/behat_ibexa_oss.php index 92719349..cc575400 100644 --- a/behat_ibexa_oss.php +++ b/behat_ibexa_oss.php @@ -88,6 +88,10 @@ '--disable-renderer-backgrounding', '--disable-background-timer-throttling', '--disable-backgrounding-occluded-windows', + // CI serves the site over plain HTTP, which is not a secure context. + // Treat the CI origins as trustworthy so secure-only browser APIs + // (e.g. crypto.randomUUID) behave as in production over HTTPS. + '--unsafely-treat-insecure-origin-as-secure=http://web,http://varnish', ], ], ],