## TL;DR
The proxy is killing the connection, not the target site. Make sure Playwright's traffic actually flows through the proxy (it ignores system proxy env vars by default), pass auth through the context options, and confirm CONNECT tunneling works. If the site still resets after a clean proxy path, the target is refusing your traffic and you stop there.

```text
playwright page.goto net::ERR_CONNECTION_RESET crawling through corporate proxy
```

## Use this when
- `page.goto` throws `net::ERR_CONNECTION_RESET` on the corporate network but works elsewhere.
- The proxy requires auth or only allows certain ports and methods.
- Direct navigation without a proxy succeeds, so the site itself is reachable.

## Not for this skill when
- The reset comes from the target site for every network. That is a block, not a proxy problem.
- The error is `net::ERR_TUNNEL_CONNECTION_FAILED`. That is a different failure (the proxy refused CONNECT outright).

## Steps
1. Pass the proxy explicitly in the context: `browser.new_context(proxy={"server": "https://example.com", "username": "USER", "password": "PASS"})`. Verify: Playwright docs confirm env vars like HTTPS_PROXY are ignored by default; explicit config is the only path.
2. Confirm the proxy allows CONNECT on port 443. Ask IT or test with curl through the proxy to an https URL. Verify: curl returns the page instead of a proxy error.
3. Listen for the failure detail: `page.on("requestfailed", r => console.log(r.failure()))`. Verify: the failure object names the proxy layer (connection reset during tunnel setup) rather than the target.
4. Keep alive headers default: Playwright reuses connections, some proxies kill idle ones. If resets cluster after pauses, recreate the context between batches. Verify: a fresh context per batch drops the reset rate.
5. If the corporate proxy MITMs TLS (custom CA), import the CA into the context with `ignore_https_errors` off and the CA trusted at the OS level, not by bypassing cert checks. Verify: navigation succeeds with strict cert validation on.

## Variant phrasings
### playwright ERR_CONNECTION_RESET proxy authentication
Auth-shaped search, same fix path: credentials must ride on the context, not the shell.
### page.goto connection reset behind corporate firewall
The firewall-intercept search, solved at step 2 with the CONNECT test.
### playwright proxy tunnel reset
Tunnel-focused phrasing, points at the CONNECT handshake.

Compatibility: Playwright 1.x (Chromium). Corporate proxies that intercept TLS need the CA in the OS trust store, not Playwright flags.

## Why it happens
Playwright does not read system proxy environment variables, so traffic leaves the browser directly and hits a corporate firewall that only permits proxied traffic. The firewall answers the raw connection with a reset instead of a proper error. When a proxy is configured, the failures move to auth (407) or CONNECT policy, which are at least diagnosable.

## Edge cases / pitfalls
- NTLM/Kerberos proxies need per-request auth Playwright cannot do natively. Route through a local forwarding proxy that handles the handshake.
- PAC files are not evaluated by Playwright. Resolve the PAC yourself and pass the chosen server.
- Resets that appear only after N minutes are idle-timeout kills. Do not retry blindly; rotate the context instead.
- Never downgrade to `ignore_https_errors: True` on a corporate network. A MITM you cannot identify is a finding, not a config option.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_KvFcND1X3Cnnz39wpSk8AQ