Some chrome flags not working in headless mode

Steps to reproduce

Tell us about your environment:

• Puppeteer version: 1.11.0
• Platform / OS version: Windows 7/10
• URLs (if applicable):
• Node.js version: 10.14.1

What steps will reproduce the problem?

'use strict';

const URL = 'https://www.allaboutwomen.in/sitemap.xml';

const puppeteer = require('puppeteer');

(async() => {

const browser = await puppeteer.launch({
		headless: true,
		ignoreHTTPSErrors: true,
		args: ['--disable-web-security', '--allow-running-insecure-content']
	});
const page = await browser.newPage();
await page.on('response', response => {
  const url = response.url();
  if (!url.startsWith('data:') && response.ok) {
    response.buffer().then(
        b => {
          console.log(`${response.status()} ${url} ${b.length} bytes`);
        },
        e => {
          console.error(`${response.status()} ${url} failed: ${e}`);
        }
    );
  }
});

await page.goto(URL);

})();

What is the expected result?

With headless: false the result is:

200 https://www.allaboutwomen.in/sitemap.xml 5398333 bytes
200 https://carzoom.in/wp-content/plugins/google-sitemap-generator/sitemap.xsl 6608 bytes
200 https://www.allaboutwomen.in/favicon.ico 0 bytes

What happens instead?

With headless: true the result is:

200 https://www.allaboutwomen.in/sitemap.xml 5398333 bytes

http://carzoom.in/wp-content/plugins/google-sitemap-generator/sitemap.xsl URL status is blocked: origin which is legit but --disable-web-security doesn’t work. When --disable-web-security works (with headless: false) the same URL status is then blocked: mixed-content which is still legit but --allow-running-insecure-content flag doesn’t work to disable it.

[aslushnikov]

@dhijn the best we have is the source code:

• the list of //content switches: //content/public/common/content_switches.h
• the list of //headless switches: //headless/app/headless_shell_switches.h

If you’re comfortable with https://cs.chromium.org, than you can search for the flag and see where it is used. If it lives somewhere under //chrome, than it’s Chromium-only.

[sohaib17]

crbug: https://crbug.com/1352473