WaitForNetworkIdleAsync times out on sites with require-trusted-types-for CSP header

[blauenlabs]

Issue:
The offline capability check consistently times out after 20 seconds regardless
of SW complexity. Tested with a minimal 3-line service worker and still times out.

CSP headers on the site include:
require-trusted-types-for 'script'; trusted-types json-formatter-policy;

Theory:
PWABuilder's Puppeteer instance may be triggering a Trusted Types violation
internally when evaluating the page, which prevents the page from ever reaching
network idle.

Steps to reproduce:

1. Add require-trusted-types-for 'script' to your site's CSP
2. Submit to PWABuilder report card
3. Offline capability check times out every time

Expected: Check passes or fails cleanly within timeout
Actual: TimeoutException after 20000ms every time

Build environment:

• Static site generator: Lume 3.1.4 (Deno-based, loaded via jsdelivr CDN)
• Runtime: Deno 2.7
• Bundler: esbuild (via Lume's esbuild plugin)
• Hosting: Cloudflare (CDN in front of static origin)
• Output: fully static HTML/JS/CSS, no SSR
• Unstable Deno APIs in use: temporal, fmt-component

[JudahGabriel]

Blauen Labs (@blauenlabs) Hmm, I don't think Puppeteer will violate that CSP. Got a demo URL I can try?

[blauenlabs]

Hi Judah Gabriel Himango (@JudahGabriel),

Thanks for looking into this.

Here are the relevant links:

• PWA: https://blauenlabs.com/tools/json/
• PWABuilder report card: https://www.pwabuilder.com/reportcard?site=https://blauenlabs.com/tools/json/

PWABuilder is now correctly detecting the service worker at
https://blauenlabs.com/tools/json/sw.js, and you can also verify it’s active in DevTools (Inspect → Application → Service Workers).

However, the original issue still persists — the WaitForNetworkIdleAsync timeout continues to occur:

[Information] Found service worker URL https://blauenlabs.com/tools/json/sw.js via Puppeteer.
[Warning] Error checking offline capability | Exception: TimeoutException: Timeout of 20000 ms exceeded
   at PuppeteerSharp.Cdp.CdpPage.WaitForNetworkIdleAsync
   at PWABuilder.Services.ServiceWorkerAnalyzer.TryRunOfflineCheck

This suggests that WaitForNetworkIdleAsync never settles. Our current theory is that the CSP directive require-trusted-types-for 'script' may be interfering with Puppeteer’s script execution, preventing it from completing evaluation and keeping the network perpetually active.

Let me know if you’re able to reproduce this or if there’s anything else I can provide to help debug.

Thanks again!

[JudahGabriel]

Update: the backend is throwing an error saying,

Offline capability check failed due to an exception: Timeout of 20000 ms exceeded

In short, PWABuilder tests offline check by:

1. Navigating to your URL
2. Waiting for your app's network to be idle
3. Simulating network disconnected
4. Reloading your web app

Unfortunately, step 2 is failing for your URL. After 20 seconds, your app never reports network idle.

I'll do some more investigation to determine why that is. But at initial glance, it appears unrelated to CSP header.