Is there a --disable-web-security fix for recent changes of Chrome ~70?

user_607033 0
Viewed 667

I do cross-origin, cross-frame scripting in one of my projects (end to end testing with client side js without selenium) and that project highly relies on the --disable-web-security flag. From today one of my tests is failing. It tries to load a non-existent remote URI to a child window to check whether an error is thrown by the lib. Well I got an error, but that is a security error, so not what I expect. The other tests are between the karma server on localhost:9876 and a node server on localhost:4444. Those are working properly. My karma contains a Chrome custom launcher with the flag:

    customLaunchers: {
        "ch": {
            "base": "Chrome",
            "flags": ["--disable-web-security"]
        }
    },

As far as I know it needs some sort of user dir too, but the Karma launcher fills that param. Any idea about whether I can fix this or at least what release of Chrome changed the behavior? (I have already sent a bug report.)

Note that the question has nothing to do with Karma. All it does is starting Chrome from CLI with the given flags. A possible fix would be adding another flag, like the --user-data-dir was, but I guess the current changes are intentional and they cannot be undone. I'd like to see where this was discussed. I only found a 5 years old topic in Chromium Google Gorups which discusses this: https://groups.google.com/a/chromium.org/forum/#!msg/chromium-dev/iivpdszNY3I/3o3BF_mGwlIJ

google-chrome javascript
1 Answers

Using --disable-site-isolation-trials is a partial solution. It works on https://www.google.com, but does not work on Chrome error pages with the error:// protocol.

user_6070330
Related