Remove disable-web-security chrome flag (#53)

Fix `Origin` header on requests

CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.2.1 - Remove disable web security flags
+
+- fix: `--disable-web-security` removed. This causes Chrome to omit the Origin
+        header when enabled.
+
 ## 0.2.0 - Add support for native `fetch` proxying
 
 - feat: Support `globalThis.fetch` proxying, allowing native fetch requests to be cached/stubbed/etc

package.json

@@ -1,6 +1,6 @@
 {
   "name": "jambox",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Tool for recording and playing back HTTP requests.",
   "bin": {
     "jam": "./jam.mjs",

src/browser.mjs

@@ -30,14 +30,14 @@ const mac = ({ chrome, uri, info }) => {
       '--args',
       uri,
       '--args',
-      '--disable-web-security',
       '--disable-features=ChromeWhatsNewUI',
       '--disable-background-networking',
       '--disable-component-update',
       '--check-for-update-interval=31536000',
       // Proxy
       `--proxy-server=${info.proxy.http}`,
-      `--proxy-bypass-list=${info.noProxy.join(',')}`,
+      // https://www.chromium.org/developers/design-documents/network-settings/
+      `--proxy-bypass-list="${info.noProxy.join(';')}"`,
       // FIXME: Don't depend on browser-launchers profile
       `--user-data-dir=${
         osenv.home() +
@@ -88,7 +88,6 @@ async function launchProxiedChrome(uri, info) {
         detached: true,
         profile: null,
         options: [
-          '--disable-web-security',
           `--ignore-certificate-errors-spki-list=${SPKI_FINGERPRINT}`,
           '--disable-features=ChromeWhatsNewUI',
           '--disable-background-networking',