Skip to content

Proxy disabled: popups never enable interception on their child sessions — service workers and OOPIFs inside popups escape to the network #34626

Description

@AtofStryker

#34555 fixed service-worker sessions and #34622 fixed OOPIF sessions, but only on the main page client: createCdpFetchRuntime assigns onChildTargetAttached on deps.client only.

The extra-target path never gets the hook. attachExtraTarget (in packages/server/lib/network-runtime.ts) takes client: Pick<ICriClient, 'send' | 'on' | 'off'>onChildTargetAttached isn't even in the Pick — and nothing assigns it on the popup's CriClient. So when a popup's own child targets attach (a service worker it registers, or a cross-origin iframe it embeds that Chromium promotes to an OOPIF), their sessions are released from the debugger pause without Fetch.enable, and their traffic bypasses interception and goes to the real network.

This was already noted as the open popup-SW gap during the service-worker spike; #34622 widened the family to iframes without covering the popup path for either type.

Fix direction

Widen attachExtraTarget's Pick to include onChildTargetAttached and assign it to the extra-target transport's attachChildSession, mirroring the main-client wiring in createCdpFetchRuntime.start(). Clear it on detach. The ordering guarantee (enable while the target is still debugger-paused) already lives in CriClient._onAttachedToTarget and applies to any client with the hook set.

Out of scope for the HTTP/2 MVP — backlog.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions