From 5074f70234d518b04400227c616ca682f6f0c309 Mon Sep 17 00:00:00 2001 From: Simon Knott Date: Wed, 5 Aug 2026 11:52:16 +0200 Subject: [PATCH] fix(mcp): only enable /killkillkill under test Fixes: https://github.com/microsoft/playwright/issues/42129 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: bcb5b8bb-90b5-4bc9-baae-64ab11a9c665 --- packages/playwright-core/src/tools/utils/mcp/http.ts | 10 ++-------- tests/mcp/http.spec.ts | 2 +- 2 files changed, 3 insertions(+), 9 deletions(-) diff --git a/packages/playwright-core/src/tools/utils/mcp/http.ts b/packages/playwright-core/src/tools/utils/mcp/http.ts index 4f81786960b3f..d6d97ab9e2460 100644 --- a/packages/playwright-core/src/tools/utils/mcp/http.ts +++ b/packages/playwright-core/src/tools/utils/mcp/http.ts @@ -22,6 +22,7 @@ import crypto from 'crypto'; import debug from 'debug'; import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js'; import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'; +import { isUnderTest } from '@utils/debug'; import { urlHostFromAddress } from '@utils/httpServer'; import { createHttpServer, startHttpServer } from '@utils/network'; import { ManualPromise } from '@isomorphic/manualPromise'; @@ -82,14 +83,7 @@ async function installHttpTransport(httpServer: http.Server, serverBackendFactor } const url = new URL(`http://localhost${req.url}`); - if (url.pathname === '/killkillkill') { - // Require POST plus a custom header to prevent cross-origin CSRF - // (a browser-coerced GET or simple
POST can't add custom headers, - // and any cross-origin request with custom headers is blocked by CORS preflight). - if (req.method !== 'POST' || req.headers['x-pw-mcp-kill'] !== '1') { - res.statusCode = 405; - return res.end(); - } + if (url.pathname === '/killkillkill' && isUnderTest()) { res.statusCode = 200; res.end('Killing process'); // Simulate Ctrl+C in a way that works on Windows too. diff --git a/tests/mcp/http.spec.ts b/tests/mcp/http.spec.ts index a63fec5927998..1a81fd49c266a 100644 --- a/tests/mcp/http.spec.ts +++ b/tests/mcp/http.spec.ts @@ -152,7 +152,7 @@ test('http transport browser sigint', async ({ serverEndpoint, server }) => { arguments: { url: server.HELLO_WORLD }, }); - await fetch(new URL('/killkillkill', url).href, { method: 'POST', headers: { 'x-pw-mcp-kill': '1' } }).catch(() => {}); + await fetch(new URL('/killkillkill', url).href).catch(() => {}); await expect.poll(() => formatLog(stderr())).toEqual({ 'create browser (isolated)': 1,