Support websites with CSP truested-types about cli HOT 3 CLOSED

Hey @bjarketrux 👋

@percy/dom package runs on the client's test browser when percySnapshot is called, it requires the server which is serving the document to not send the CSP header for it to able to run.

you can verify it by doing the following

npx percy exec:start --debug

eval(await (await fetch('http://localhost:5338/percy/dom.js')).text())
PercyDom.serialize()

The support for this would need to be built on the user's end by either having a proxy that drops the CSP header or whitelisting for it to run E2E

from cli.

Okay so the conclusion is wont-fix and with the following options as work around:

• Use Firefox as it ignores trusted-types for now
• Disable CSP headers on the code under test (only possible if debug environment)
• Use a proxy server which strips away the CSP header

You mention whitelisting. Does percy has a trusted type policy name we can use?

from cli.

You mention whitelisting. Does percy has a trusted type policy name we can use?

nothing that I could think of for trusted type, but say for connect-src e.t.c we may use localhost:5338

from cli.