[rb] support serving test pages over HTTPS for certificate and cookie tests - #18152

• Serve Ruby spec pages over HTTP and HTTPS using the shared self-signed certificate.
• Run secure-cookie specs against local HTTPS and add BiDi certificate-acceptance coverage.
• Include certificates in Ruby integration test data and skip unsupported Safari certificate tests.

graph TD
  Specs["Cookie and BiDi specs"] --> Helpers["URL helpers"] --> Env["Test environment"] --> Server(["WEBrick listeners"]) --> Pages["Shared web pages"]
  Certs["Shared certificate"] --> Server
  Specs --> Browser["Browser driver"] --> Server

Loading

Keep the dual local listeners: existing specs retain HTTP, while HTTPS-dependent specs gain a controlled origin without relying on external sites. An HTTPS-only server would disrupt HTTP coverage, and external HTTPS sites would make tests less reliable.

Enhancement (3) +25 / -26

helpers.rbExpose secure URLs through spec helpers +2/-2

Expose secure URLs through spec helpers

• Adds an optional secure keyword to the URL helper and forwards it to the test environment, preserving HTTP as the default.

rb/spec/integration/selenium/webdriver/spec_support/helpers.rb

rack_server.rbServe spec pages on HTTP and HTTPS listeners +18/-21

Serve spec pages on HTTP and HTTPS listeners

• Starts separate WEBrick listeners for the same test app, configuring HTTPS with the shared localhost certificate and key. Waits for both ports, returns protocol-specific URLs, and removes legacy handler probing in favor of WEBrick.

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb

test_environment.rbConfigure the secure spec-server port and certificate path +5/-3

Configure the secure spec-server port and certificate path

• Chooses both server ports before startup and passes the shared certificate directory to RackServer. Propagates the optional secure URL selection to callers.

rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb

Tests (2) +35 / -22

browser_spec.rbTest BiDi acceptance of the local certificate +14/-0

Test BiDi acceptance of the local certificate

• Adds a user-context spec that enables insecure certificates, navigates to a local HTTPS page, and verifies the resulting URL. The spec closes its browsing context and removes the user context afterward.

rb/spec/integration/selenium/webdriver/bidi/protocol/browser_spec.rb

manager_spec.rbRun secure-cookie specs against local HTTPS +21/-22

Run secure-cookie specs against local HTTPS

• Replaces skipped external-site secure and SameSite=None cookie cases with local HTTPS tests that reset the driver to accept the self-signed certificate. Skips those cases on Safari and clarifies why the HTTP rejection case remains guarded.

rb/spec/integration/selenium/webdriver/manager_spec.rb

Other (2) +14 / -3

BUILD.bazelExpose localhost certificates to Ruby specs +4/-1

Expose localhost certificates to Ruby specs

• Extends the certificate filegroup's visibility to Ruby spec subpackages so Bazel integration targets can include the certificate and key.

common/certificates/BUILD.bazel

tests.bzlInclude certificates in Ruby integration test data +10/-2

Include certificates in Ruby integration test data

• Adds the shared certificate filegroup to local and remote Ruby integration targets for both classic WebDriver and BiDi, making the HTTPS listener's files available under Bazel.

rb/spec/tests.bzl

Description

serve calls Rack::Handler::WEBrick.run concurrently for HTTP and HTTPS, while the installed Rack
handler stores the server in one shared instance variable and rereads it when mounting and starting
it. If one thread replaces that variable while the other is starting, both calls can start the same
server, leaving one port unserved and causing spec-server startup to time out.

Code

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[78]

+          Rack::Handler::WEBrick.run @app, **options, **ssl

Evidence

Both the forked and threaded startup paths call serve concurrently for the two ports. The locked
Rack version is 2.2.24; its WEBrick handler assigns @server and then accesses @server again for
mount and start, allowing one call to operate on the other call's server.

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[54-56]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[76-78]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[93-97]
rb/Gemfile.lock[67-67]
🌐 The Rack 2.2 handler's run method assigns a shared @server, then uses that variable for mounting and starting the server.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Concurrent calls to Rack's WEBrick handler share its server instance variable, so one listener can remain unserved.

## Fix Focus Areas
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[76-78]
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[54-56]
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[95-95]

## Recommended Fix
Construct, mount, and start each WEBrick server using a thread-local server reference rather than calling the shared Rack handler's `run` method concurrently. Preserve separate references for shutdown.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

RackServer#run starts the HTTPS listener in an untracked thread, while start_threaded records
only the outer thread and stop kills only that recorded thread. On Windows, JRuby, and
TruffleRuby, GlobalTestEnv#quit therefore leaves the HTTPS listener active after stopping the test
server, including when the environment is reused in the same process; the changed lifecycle has no
test to catch this.

Code

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[R53-54]

+          Thread.new { Rack::Handler::WEBrick.run @app, **server_options(@secure_port), **ssl_options }
+          Rack::Handler::WEBrick.run @app, **server_options(@port)

Evidence

The changed run method creates an HTTPS thread without retaining it, while start_threaded saves
only the outer thread and stop kills only that saved thread. GlobalTestEnv#quit calls stop, so
its shutdown path does not reach the HTTPS listener; the changed behavior also lacks the applicable
test coverage called for by the checklist.

AGENTS.md: Use Small Tests That Exercise Real API Contracts
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[39-54]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[61-66]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[89-96]
rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[213-219]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[40-54]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[89-95]
rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[213-218]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
On threaded platforms, stopping the test server stops the recorded outer thread but leaves the separately started HTTPS listener running. The changed shutdown lifecycle also needs test coverage.

## Fix Focus Areas
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[51-66]
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[89-95]

## Recommended Fix
Retain references to both listener threads or server instances. Update `stop` to shut down both listeners and join their threads. Add a focused test that starts both listeners, stops the server, and verifies that neither listener remains active.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

BufferedTlsRequest#run makes wait_readable return true for every TLS socket, so WEBrick
proceeds to parse even when no HTTP request is available. A client that completes the TLS handshake
but sends no request then blocks inside request parsing instead of reaching WEBrick's request
timeout, leaving the secure listener's thread and socket occupied.

Code

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[R37-38]

+              io.define_singleton_method(:wait_readable) { |_timeout| true }
+              sock.define_singleton_method(:to_io) { io }

Evidence

The workaround applies to every accepted OpenSSL TLS socket, while WEBrick's HTTPServer#run uses
sock.to_io.wait_readable before parsing the request. Returning true unconditionally skips that
timeout/readiness check; the secure server is started with these sockets through the HTTPS WEBrick
listener.

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[31-40]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[69-73]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The JRuby workaround overrides the delegated socket's `wait_readable` to always return `true`, bypassing WEBrick's readiness timeout. After a TLS handshake, an idle client can therefore block indefinitely in HTTP request parsing and consume a WEBrick request thread.

### Fix Focus Areas
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[31-44]

### Recommended Fix
Replace the unconditional readiness result with a bounded readiness implementation that still accommodates JRuby's buffered TLS data without bypassing idle-request timeouts. If the underlying socket cannot expose buffered data reliably, enforce `RequestTimeout` around the subsequent request parse so idle TLS clients cannot retain server threads indefinitely.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

run starts HTTPS in a separate thread, allowing the HTTP server to keep running when certificate
loading or the HTTPS bind fails. In forked mode the parent eventually times out waiting for the
secure port, but app_server has not stored the server instance, so its normal cleanup cannot reach
the still-running child.

Code

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[R53-54]

+          Thread.new { Rack::Handler::WEBrick.run @app, **server_options(@secure_port), **ssl_options }
+          Rack::Handler::WEBrick.run @app, **server_options(@port)

Evidence

HTTPS setup and binding happen in the new thread, while HTTP remains in run. The parent requires
connectivity to both ports; the environment assigns @app_server only after start succeeds, and
quit cleans up only an assigned server.

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[43-54]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[78-94]
rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[104-111]
rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[213-218]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
An HTTPS startup failure can leave the forked HTTP server running after `start` times out.
## Fix Focus Areas
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[40-54]
- rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[104-111]
## Recommended Fix
Propagate HTTPS-thread startup failures to the process supervising startup and ensure a failed `start` stops and reaps any listener or child it created.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

app_server calls random_port twice, but each call closes its socket before either listener
binds, so both calls can return the same port. If HTTP wins the bind, startup can report both ports
connected even though the HTTPS listener failed, and secure test URLs then reach a plain HTTP
server.

Code

rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[R106-108]

+            app_server = RackServer.new(root.join('common/src/web').to_s, random_port,
+                                        secure_port: random_port,
+                                        certificates: root.join('common/certificates').to_s)

Evidence

random_port closes its bound socket before returning, the new call selects a second port without
checking it against the first, and startup polls both supplied numbers using only TCP connectivity.

rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[106-108]
rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[425-436]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[43-54]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The two independently selected ports can be identical because `random_port` closes each socket before the listeners bind.
## Fix Focus Areas
- rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[104-108]
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[40-54]
## Recommended Fix
Ensure the HTTP and HTTPS listeners receive distinct ports, with port ownership maintained until each listener binds; do not treat two connections to one port as proof that both listeners started.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

💡 Did you know, you can commit Qodo's fix in one click with committable suggestions (GitHub & GitLab)

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Review updated until commit f7cfd9d

Results up to commit 4fb429f ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Secure server survives test shutdown ✓ Resolved

Description

RackServer#run starts the HTTPS listener in an untracked thread, while start_threaded records
only the outer thread and stop kills only that recorded thread. On Windows, JRuby, and
TruffleRuby, GlobalTestEnv#quit therefore leaves the HTTPS listener active after stopping the test
server, including when the environment is reused in the same process; the changed lifecycle has no
test to catch this.

Code

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[R53-54]

+          Thread.new { Rack::Handler::WEBrick.run @app, **server_options(@secure_port), **ssl_options }
+          Rack::Handler::WEBrick.run @app, **server_options(@port)

Evidence

The changed run method creates an HTTPS thread without retaining it, while start_threaded saves
only the outer thread and stop kills only that saved thread. GlobalTestEnv#quit calls stop, so
its shutdown path does not reach the HTTPS listener; the changed behavior also lacks the applicable
test coverage called for by the checklist.

AGENTS.md: Use Small Tests That Exercise Real API Contracts
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[39-54]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[61-66]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[89-96]
rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[213-219]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[40-54]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[89-95]
rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[213-218]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
On threaded platforms, stopping the test server stops the recorded outer thread but leaves the separately started HTTPS listener running. The changed shutdown lifecycle also needs test coverage.

## Fix Focus Areas
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[51-66]
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[89-95]

## Recommended Fix
Retain references to both listener threads or server instances. Update `stop` to shut down both listeners and join their threads. Add a focused test that starts both listeners, stops the server, and verifies that neither listener remains active.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. A failed secure startup leaves an orphan ✓ Resolved

Description

run starts HTTPS in a separate thread, allowing the HTTP server to keep running when certificate
loading or the HTTPS bind fails. In forked mode the parent eventually times out waiting for the
secure port, but app_server has not stored the server instance, so its normal cleanup cannot reach
the still-running child.

Code

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[R53-54]

+          Thread.new { Rack::Handler::WEBrick.run @app, **server_options(@secure_port), **ssl_options }
+          Rack::Handler::WEBrick.run @app, **server_options(@port)

Evidence

HTTPS setup and binding happen in the new thread, while HTTP remains in run. The parent requires
connectivity to both ports; the environment assigns @app_server only after start succeeds, and
quit cleans up only an assigned server.

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[43-54]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[78-94]
rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[104-111]
rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[213-218]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
An HTTPS startup failure can leave the forked HTTP server running after `start` times out.
## Fix Focus Areas
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[40-54]
- rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[104-111]
## Recommended Fix
Propagate HTTPS-thread startup failures to the process supervising startup and ensure a failed `start` stops and reaps any listener or child it created.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Secure pages can reach the plain server ✓ Resolved

Description

app_server calls random_port twice, but each call closes its socket before either listener
binds, so both calls can return the same port. If HTTP wins the bind, startup can report both ports
connected even though the HTTPS listener failed, and secure test URLs then reach a plain HTTP
server.

Code

rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[R106-108]

+            app_server = RackServer.new(root.join('common/src/web').to_s, random_port,
+                                        secure_port: random_port,
+                                        certificates: root.join('common/certificates').to_s)

Evidence

random_port closes its bound socket before returning, the new call selects a second port without
checking it against the first, and startup polls both supplied numbers using only TCP connectivity.

rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[106-108]
rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[425-436]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[43-54]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The two independently selected ports can be identical because `random_port` closes each socket before the listeners bind.
## Fix Focus Areas
- rb/spec/integration/selenium/webdriver/spec_support/test_environment.rb[104-108]
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[40-54]
## Recommended Fix
Ensure the HTTP and HTTPS listeners receive distinct ports, with port ownership maintained until each listener binds; do not treat two connections to one port as proof that both listeners started.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Results up to commit bf490f8 ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Test pages intermittently fail to load ✓ Resolved

Description

serve calls Rack::Handler::WEBrick.run concurrently for HTTP and HTTPS, while the installed Rack
handler stores the server in one shared instance variable and rereads it when mounting and starting
it. If one thread replaces that variable while the other is starting, both calls can start the same
server, leaving one port unserved and causing spec-server startup to time out.

Code

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[78]

+          Rack::Handler::WEBrick.run @app, **options, **ssl

Evidence

Both the forked and threaded startup paths call serve concurrently for the two ports. The locked
Rack version is 2.2.24; its WEBrick handler assigns @server and then accesses @server again for
mount and start, allowing one call to operate on the other call's server.

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[54-56]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[76-78]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[93-97]
rb/Gemfile.lock[67-67]
🌐 The Rack 2.2 handler's run method assigns a shared @server, then uses that variable for mounting and starting the server.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Concurrent calls to Rack's WEBrick handler share its server instance variable, so one listener can remain unserved.

## Fix Focus Areas
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[76-78]
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[54-56]
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[95-95]

## Recommended Fix
Construct, mount, and start each WEBrick server using a thread-local server reference rather than calling the shared Rack handler's `run` method concurrently. Preserve separate references for shutdown.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Results up to commit cc1743a 🚀 Fast

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Idle secure clients consume server threads ✓ Resolved

Description

BufferedTlsRequest#run makes wait_readable return true for every TLS socket, so WEBrick
proceeds to parse even when no HTTP request is available. A client that completes the TLS handshake
but sends no request then blocks inside request parsing instead of reaching WEBrick's request
timeout, leaving the secure listener's thread and socket occupied.

Code

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[R37-38]

+              io.define_singleton_method(:wait_readable) { |_timeout| true }
+              sock.define_singleton_method(:to_io) { io }

Evidence

The workaround applies to every accepted OpenSSL TLS socket, while WEBrick's HTTPServer#run uses
sock.to_io.wait_readable before parsing the request. Returning true unconditionally skips that
timeout/readiness check; the secure server is started with these sockets through the HTTPS WEBrick
listener.

rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[31-40]
rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[69-73]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The JRuby workaround overrides the delegated socket's `wait_readable` to always return `true`, bypassing WEBrick's readiness timeout. After a TLS handshake, an idle client can therefore block indefinitely in HTTP request parsing and consume a WEBrick request thread.

### Fix Focus Areas
- rb/spec/integration/selenium/webdriver/spec_support/rack_server.rb[31-44]

### Recommended Fix
Replace the unconditional readiness result with a bounded readiness implementation that still accommodates JRuby's buffered TLS data without bypassing idle-request timeouts. If the underlying socket cannot expose buffered data reliably, enforce `RequestTimeout` around the subsequent request parse so idle TLS clients cannot retain server threads indefinitely.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---