Closed tgrushka closed 5 months ago
The Node way to do this is via NODE_EXTRA_CA_CERTS
(https://nodejs.org/api/cli.html#node_extra_ca_certsfile). You can specify an environment variable pointing to the cert that Node should recognize.
As for overriding where/how we fetch...
If you use engineMode: "REMOTE"
it tells our checker to fetch ${config.rulePack}/ace.js
directly into the browser. The fetch is handled by the browser within the page context, so things that you do in the Node environment don't affect this kind of fetch - it's executed with the page's javascript context, not the Node context.
The default setting is engineMode: "INJECT"
. This will fetch ${config.rulePack}/ace.js
and then push it to the browser through the browser automation protocol (Puppeteer, Selenium, etc). You could pre-fetch ace.js and place it wherever you like and override with the rulePack configuration to fetch from some other location of your choosing.
I suspect NODE_EXTRA_CA_CERTS
with the default INJECT
setting is what you're really looking for.
Given no further follow-up, closing...
Project
accessibility-checker for Node
Browser
Chrome
Operating system
MacOS, Other
Description
Error that led to this problem:
UNABLE_TO_VERIFY_LEAF_SIGNATURE
when using a proxy server with self-signed TLS certificate, even whenengineMode: "REMOTE"
and passing in Playwright page togetCompliance()
, because Accessibility Checker loads its config directly using fetch/axios outside this context.Accessibility Checker (Engine) has a convoluted process for getting its config and retrieving checker rules. It forces use of its internal
fetch_get_text
andfetch_get_json
functions which cannot be overridden to user's environment preferences.For example:
It does not respect these environment variables either: NODE_OPTIONS=--use-openssl-ca NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
These are working fine for me in my container environment in
node-fetch
package, and in Playwright. The only way I found to override was to overrideglobal.fetch
as follows, which, in my case, has to use apage.evaluate
to fetch from the browser's context, in which I have properly set up my proxy config, and which respects the machine's trusted certificate store.My override, in case it helps someone else (that took hours trying to monkey-patch
ACEngineManager
andACConfigManager
, to no avail):Expected Behavior
If we set
engineMode: "REMOTE"
in.achecker.yml
(would be nice to not need a file and be able to useawait ACConfigManager.setConfig(config)
in code instead, but that's another issue), Accessibility Checker should respect our settings and retrieve its dependencies inside whatever context we configured, i.e. Playwright, Puppeteer, etc., or allow us to override the configuration for proxy server and TLS certificates.(
NODE_TLS_REJECT_UNAUTHORIZED
is a last resort, should not be required to do this, should not be set globally by the checker, and should be set on a per-request basis, or allow the user to override it in the config only for the checker and not globally. Further, it does not work for self-signed proxy certificates.)Steps to reproduce
curl -x
,httpie --proxy
, etc. trust the certificate and do not throw an unverified certificate error;page
instance with a URL to test;await getCompliance(page)
on the page;UNABLE_TO_VERIFY_LEAF_SIGNATURE
error.