Lightpanda Browser

This is a Lightpanda bug (present in 1.0.1 and main @3476970a). With Fetch.enable({handleAuthRequests: true}) — which is what Puppeteer's page.setRequestInterception(true) sends — Lightpanda treats every 401/407 response as an HTTP auth challenge even when the response has no WWW-Authenticate/Proxy-Authenticate header. It emits Fetch.authRequired with an empty challenge (source: "", scheme: ""), and when the client replies with Default or CancelAuth (Puppeteer's default), Lightpanda aborts the request with AbortAuthChallenge instead of delivering the 401 to the page. SPAs using cookie/session auth that return bare 401s therefore see fetch() reject. Workarounds: (1) Enable interception via raw CDP with handleAuthRequests: false — the http_request_auth_required listener is then never registered, the transfer is not parked, and the 401 reaches the page. (2) Scope Fetch.enable with URL patterns that exclude your API, e.g. Fetch.enable({patterns: [{urlPattern: '*/assets/*'}], handleAuthRequests: true}) — requests not matching the pattern bypass interception and receive the real 401. Chrome differs in two ways: it only fires Fetch.authRequired when a real challenge header exists, and for Default/CancelAuth answers it cancels the auth flow but still delivers the original 401 response. Track issue #4018 for a fix aligning Lightpanda with Chrome.