playwright page.goto net::ERR_CONNECTION_RESET crawling through corporate proxy

TL;DR

The proxy is killing the connection, not the target site. Make sure Playwright's traffic actually flows through the proxy (it ignores system proxy env vars by default), pass auth through the context options, and confirm CONNECT tunneling works. If the site still resets after a clean proxy path, the target is refusing your traffic and you stop there.

playwright page.goto net::ERR_CONNECTION_RESET crawling through corporate proxy

Use this when

• page.goto throws net::ERR_CONNECTION_RESET on the corporate network but works elsewhere.
• The proxy requires auth or only allows certain ports and methods.
• Direct navigation without a proxy succeeds, so the site itself is reachable.

Not for this skill when

• The reset comes from the target site for every network. That is a block, not a proxy problem.
• The error is net::ERR_TUNNEL_CONNECTION_FAILED. That is a different failure (the proxy refused CONNECT outright).

Steps

1. Pass the proxy explicitly in the context: browser.new_context(proxy={"server": "https://example.com", "username": "USER", "password": "PASS"}). Verify: Playwright docs confirm env vars like HTTPS_PROXY are ignored by default; explicit config is the only path.
2. Confirm the proxy allows CONNECT on port 443. Ask IT or test with curl through the proxy to an https URL. Verify: curl returns the page instead of a proxy error.
3. Listen for the failure detail: page.on("requestfailed", r => console.log(r.failure())). Verify: the failure object names the proxy layer (connection reset during tunnel setup) rather than the target.
4. Keep alive headers default: Playwright reuses connections, some proxies kill idle ones. If resets cluster after pauses, recreate the context between batches. Verify: a fresh context per batch drops the reset rate.
5. If the corporate proxy MITMs TLS (custom CA), import the CA into the context with ignore_https_errors off and the CA trusted at the OS level, not by bypassing cert checks. Verify: navigation succeeds with strict cert validation on.

Variant phrasings

playwright ERRCONNECTIONRESET proxy authentication

Auth-shaped search, same fix path: credentials must ride on the context, not the shell.

page.goto connection reset behind corporate firewall

The firewall-intercept search, solved at step 2 with the CONNECT test.

playwright proxy tunnel reset

Tunnel-focused phrasing, points at the CONNECT handshake.

Compatibility: Playwright 1.x (Chromium). Corporate proxies that intercept TLS need the CA in the OS trust store, not Playwright flags.

Why it happens

Playwright does not read system proxy environment variables, so traffic leaves the browser directly and hits a corporate firewall that only permits proxied traffic. The firewall answers the raw connection with a reset instead of a proper error. When a proxy is configured, the failures move to auth (407) or CONNECT policy, which are at least diagnosable.

Edge cases / pitfalls

• NTLM/Kerberos proxies need per-request auth Playwright cannot do natively. Route through a local forwarding proxy that handles the handshake.
• PAC files are not evaluated by Playwright. Resolve the PAC yourself and pass the chosen server.
• Resets that appear only after N minutes are idle-timeout kills. Do not retry blindly; rotate the context instead.
• Never downgrade to ignore_https_errors: True on a corporate network. A MITM you cannot identify is a finding, not a config option.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_KvFcND1X3Cnnz39wpSk8AQ