fix(client-certificates): honor browser-level proxy and proxy.bypass

packages/playwright-core/src/server/browser.ts

@@ -108,7 +108,8 @@ export abstract class Browser extends SdkObject {
     let context: BrowserContext | undefined;
     try {
       if (options.clientCertificates?.length) {
-        clientCertificatesProxy = await ClientCertificatesProxy.create(progress, options);
+        // The interceptor replaces the browser proxy, so it must apply the browser-level proxy itself.
+        clientCertificatesProxy = await ClientCertificatesProxy.create(progress, { ...options, proxy: options.proxy ?? this.options.proxy });
         options = { ...options };
         options.proxyOverride = clientCertificatesProxy.proxySettings();
         options.internalIgnoreHTTPSErrors = true;

packages/playwright-core/src/server/socksClientCertificatesInterceptor.ts

@@ -287,7 +287,8 @@ export class ClientCertificatesProxy {
   ) {
     verifyClientCertificates(contextOptions.clientCertificates);
     this.ignoreHTTPSErrors = contextOptions.ignoreHTTPSErrors;
-    this._proxy = contextOptions.proxy;
+    // 'per-context' is a Chromium launch-time placeholder, not a real proxy.
+    this._proxy = contextOptions.proxy?.server === 'per-context' ? undefined : contextOptions.proxy;
     this._initSecureContexts(contextOptions.clientCertificates);
     this._socksProxy = new SocksProxy();
     this._socksProxy.setPattern('*');
@@ -312,9 +313,8 @@ export class ClientCertificatesProxy {
   }
 
   _getProxyAgent(host: string, port: number) {
-    const proxyFromOptions = createProxyAgent(this._proxy);
-    if (proxyFromOptions)
-      return proxyFromOptions;
+    if (this._proxy)
+      return createProxyAgent(this._proxy, new URL(`https://${host.includes(':') ? `[${host}]` : host}:${port}`));
     const proxyFromEnv = getProxyForUrl(`https://${host}:${port}`);
     if (proxyFromEnv)
       return createProxyAgent({ server: proxyFromEnv });

tests/library/client-certificates.spec.ts

@@ -498,6 +498,47 @@ test.describe('browser', () => {
     await page.close();
   });
 
+  test('should use the browser-level proxy with client certificates', async ({ browserType, startCCServer, asset, browserName, proxyServer, isMac }) => {
+    const serverURL = await startCCServer({ useFakeLocalhost: browserName === 'webkit' && isMac });
+    proxyServer.forwardTo(parseInt(new URL(serverURL).port, 10), { allowConnectRequests: true });
+    const browser = await browserType.launch({ proxy: { server: `localhost:${proxyServer.PORT}` } });
+    try {
+      const page = await browser.newPage({
+        ignoreHTTPSErrors: true,
+        clientCertificates: [{
+          origin: new URL(serverURL).origin,
+          certPath: asset('client-certificates/client/trusted/cert.pem'),
+          keyPath: asset('client-certificates/client/trusted/key.pem'),
+        }],
+      });
+      expect(proxyServer.connectHosts).toEqual([]);
+      await page.goto(serverURL);
+      const host = browserName === 'webkit' && isMac ? 'localhost' : '127.0.0.1';
+      expect([...new Set(proxyServer.connectHosts)]).toEqual([`${host}:${new URL(serverURL).port}`]);
+      await expect(page.getByTestId('message')).toHaveText('Hello Alice, your certificate was issued by localhost!');
+    } finally {
+      await browser.close();
+    }
+  });
+
+  test('should respect proxy bypass with client certificates', async ({ browser, startCCServer, asset, browserName, proxyServer, isMac }) => {
+    const serverURL = await startCCServer({ useFakeLocalhost: browserName === 'webkit' && isMac });
+    proxyServer.forwardTo(parseInt(new URL(serverURL).port, 10), { allowConnectRequests: true });
+    const page = await browser.newPage({
+      ignoreHTTPSErrors: true,
+      clientCertificates: [{
+        origin: new URL(serverURL).origin,
+        certPath: asset('client-certificates/client/trusted/cert.pem'),
+        keyPath: asset('client-certificates/client/trusted/key.pem'),
+      }],
+      proxy: { server: `localhost:${proxyServer.PORT}`, bypass: new URL(serverURL).hostname },
+    });
+    await page.goto(serverURL);
+    expect(proxyServer.connectHosts).toEqual([]);
+    await expect(page.getByTestId('message')).toHaveText('Hello Alice, your certificate was issued by localhost!');
+    await page.close();
+  });
+
   test('should pass with matching certificates and when a http proxy is used from env', async ({ mode, browser, startCCServer, asset, browserName, proxyServer, isMac }) => {
     test.skip(mode !== 'default', 'Out of process transport does not allow us to set env vars dynamically');
     process.env.HTTPS_PROXY = `http://localhost:${proxyServer.PORT}`;