chromeWebSecurity:false Limitation for Cross-Browser Certificate Validation
0 reputation · 19 Nov 2021, 10:35 UTC
Goal
Run Cypress tests against an internal service that uses a self-signed certificate or a private CA, while maintaining consistent behavior across Chromium, Firefox, and WebKit.
Constraints
Cypress drives the browser through an internal proxy, so TLS negotiation occurs in the browser. The documented chromeWebSecurity option (default true) can be set to false to relax certificate checks, but this only works in Chromium-based browsers. Firefox and WebKit do not support disabling web security via this flag, requiring the private CA to be installed in each browser's trust store instead.
Uncertainty
Teams must decide between weakening test fidelity with chromeWebSecurity:false for Chromium convenience or investing in proper CA provisioning for all target browsers. The trade-off affects mixed-content detection, certificate transparency checks, and how closely the test environment mirrors production.
What is the recommended approach for provisioning a private CA into Firefox and WebKit when running under Cypress? Does Cypress provide any built-in mechanism to inject trusted roots, or must the CA be added to the OS/browser profile manually? Are there version-specific differences in certificate error handling that would change this decision for Cypress 13+?
cypressio