testing

How PXTA Was Tested, From Fourteen Banner Setups to a 500-Page Crawl With the Browser Killed Halfway

A tool that says “this tag fired before consent” has to be right, or its reports are worse than nothing. So PXTA’s tests run real Chrome against real pages, and the results of the release run are kept in the code repository, next to the code they tested. Every number on this site comes from those files.

The run behind version 0.1 used Chrome for Testing 153 on Linux, with Go 1.24.7. All 70 tests and subtests passed. One was skipped by design: the sample report gallery, which the same script runs on its own afterwards.

The recorded crash test: 500 pages, the browser killed after page 167, one restart, 500 distinct pages recorded, 500 analytics hits recorded, and no pages with an error.

Fake Sites, Real Browser

PXTA can’t test against live websites. They change every week, and auditing a stranger’s site for a test suite isn’t polite. So the tests build their own internet. A local HTTPS server answers for every host name, and Chrome is told to send all traffic there. When a test page loads connect.facebook.net/en_US/fbevents.js, it gets a stand-in script that sends what the real pixel sends, to the same address, in the same format.

The stand-ins are written for the tests. They aren’t the vendors’ code, and they don’t need to be: PXTA reads requests, and the requests are what the stand-ins copy.

What the Fixture Sites Cover

  • Consent banners, set up right and wrong. OneTrust, Cookiebot, Didomi and Usercentrics, a generic banner found only by its button words, a banner inside an iframe, and a banner that appears late. Each one in two versions, one where the tags wait and one where they don’t. Fourteen sites, and PXTA has to tell the good from the bad in every one.
  • An email address in ten encodings. Plain, URL-encoded, double-encoded, base64, inside the page address, in a JSON body, in JSON inside a field, in JSON lines, sent as a beacon, and hashed. PXTA has to find all ten.
  • Trackers that load late, after a timer, on scroll, and from a tag manager.
  • Requests from an iframe, a worker, and a beacon sent on the way out.
  • Consent Mode saying denied while identifiers still go out.
  • A site with no trackers, which must come back clean, and a site with robots.txt rules, which must be followed.
  • Pages that get in the way: one that throws up alert, confirm and prompt dialogs, one with an OK button that isn’t a cookie banner, and a start address that redirects to www.

Crashes and Interruptions

Long audits fail. The crash test crawls 500 pages and kills the browser after page 167. PXTA has to notice, start a new browser, make the pass’s consent choice again and carry on. The recorded run shows one restart, all 500 pages recorded, and no page lost. A separate test stops an audit halfway and checks that --resume finishes it with every page recorded exactly once.

On Three Systems

Every push to the code runs the full browser suite on Linux and macOS in GitHub Actions, and a shorter set on Windows, including a complete browser audit of the shop fixture. The release archives are only built after that passes.

The test results are on GitHub, and the four sample reports are the gallery from the same run.