← →

Run #341 — DEMO-022

failed

queued 2026-09-24 20:40:49 · started 20:40:53 · finished 20:41:00 · duration 6s · target v2.0.0 · chromium · trigger: cli-adopted · batch: 3 tests (terminal)

What went wrong

AssertionError: WCAG 2.1 AA: 4 rule(s) broken (details: a11y-report.html)
  - Elements must meet minimum color contrast ratio thresholds [color-contrast]: 58 on every page
  - ARIA hidden element must not be focusable or contain focusable elements [aria-hidden-focus]: 5 on every page
  - <html> element must have a lang attribute [html-has-lang]: 5 on every page
  - <svg> elements with an img or image role must have alternative text [svg-img-alt]: 1 on home page

Technical details (full error)

AssertionError: WCAG 2.1 AA: 4 rule(s) broken (details: a11y-report.html)
  - Elements must meet minimum color contrast ratio thresholds [color-contrast]: 58 on every page
  - ARIA hidden element must not be focusable or contain focusable elements [aria-hidden-focus]: 5 on every page
  - <html> element must have a lang attribute [html-has-lang]: 5 on every page
  - <svg> elements with an img or image role must have alternative text [svg-img-alt]: 1 on home page
Traceback (most recent call last):
  File "/opt/pw-testhub/app/core/harness/run_test.py", line 737, in main
    module.run(TimedPage(page, ctx), ctx)
  File "/opt/pw-testhub/data/tests/DEMO-022__freight_accessibility.py", line 37, in run
    audit.assert_clean()
  File "/opt/pw-testhub/data/tests/_lib/a11y.py", line 108, in assert_clean
    raise AssertionError(message)
AssertionError: WCAG 2.1 AA: 4 rule(s) broken (details: a11y-report.html)
  - Elements must meet minimum color contrast ratio thresholds [color-contrast]: 58 on every page
  - ARIA hidden element must not be focusable or contain focusable elements [aria-hidden-focus]: 5 on every page
  - <html> element must have a lang attribute [html-has-lang]: 5 on every page
  - <svg> elements with an img or image role must have alternative text [svg-img-alt]: 1 on home page

the page at the moment it failed

Activity replay 4 frames, captured only while the page was actually changing — idle waits are skipped automatically

+0.00s

Step timings follows the replay — click a step to see it there

at	step	took
+0.59s	⏱ scan: home page	935 ms
+0.60s	goto http://127.0.0.1:8000/demo/freight/	164 ms
+0.76s	wait_for_load_state networkidle	438 ms
+1.20s	evaluate () => typeof window.axe === 'object'	11 ms
+1.21s	evaluate /! axe v4.13.0 Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use	158 ms
+1.37s	evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va	161 ms
+1.53s	goto http://127.0.0.1:8000/demo/freight/track/?id=AF-100001	91 ms
+1.53s	⏱ scan: tracking	766 ms
+1.62s	wait_for_load_state networkidle	480 ms
+2.10s	evaluate () => typeof window.axe === 'object'	6 ms
+2.11s	evaluate /! axe v4.13.0 Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use	98 ms
+2.21s	evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va	90 ms
+2.29s	⏱ scan: quote, step 1	688 ms
+2.30s	goto http://127.0.0.1:8000/demo/freight/quote/?restart=1	34 ms
+2.33s	wait_for_load_state networkidle	494 ms
+2.83s	evaluate () => typeof window.axe === 'object'	5 ms
+2.83s	evaluate /! axe v4.13.0 Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use	95 ms
+2.92s	evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va	59 ms
+2.99s	⏱ scan: staff sign-in	721 ms
+2.99s	goto http://127.0.0.1:8000/demo/freight/login/	31 ms
+3.02s	wait_for_load_state networkidle	492 ms
+3.50s	evaluate () => typeof window.axe === 'object'	7 ms
+3.51s	evaluate /! axe v4.13.0 Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use	118 ms
+3.64s	evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va	73 ms
+3.70s	goto http://127.0.0.1:8000/demo/freight/login/	28 ms
+3.74s	fill #username	52 ms
+3.78s	fill #password	46 ms
+3.83s	click #login-btn	120 ms
+3.95s	wait_for_selector #signed-in-user	136 ms
+4.08s	goto http://127.0.0.1:8000/demo/freight/ops/	146 ms
+4.09s	⏱ scan: staff dashboard	973 ms
+4.23s	wait_for_load_state networkidle	436 ms
+4.67s	evaluate () => typeof window.axe === 'object'	26 ms
+4.70s	evaluate /! axe v4.13.0 Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use	155 ms
+4.85s	evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va	209 ms

Times are when each step began, on the replay's clock. Add your own phases with with ctx.timed("label"):.

Screenshots

Artifacts

Run log	run.log
Playwright trace	trace.zip open with: `playwright show-trace trace.zip`
Result JSON	result.json
Saved by the test	a11y-report.html
	a11y-report.json
Folder	`results/DEMO-022/20260924-204053-r341/`

Full log

Read from the S3 bucket (the last 20 KB; the whole file is the Run log link above).

[harness] test=DEMO-022 browser=chromium headed=False timeout=120s
[harness] target: http://127.0.0.1:8000/demo/
[test] [   0.60s] starting DEMO-022
[timing] goto http://127.0.0.1:8000/demo/freight/: 164ms
[timing] wait_for_load_state networkidle: 438ms
[timing] evaluate () => typeof window.axe === 'object': 11ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 158ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 161ms
[test] [   1.53s] accessibility, home page: aria-hidden-focus (serious, 1), color-contrast (serious, 19), html-has-lang (serious, 1), svg-img-alt (serious, 1)
[timing] scan: home page: 935ms
[timing] goto http://127.0.0.1:8000/demo/freight/track/?id=AF-100001: 91ms
[timing] wait_for_load_state networkidle: 480ms
[timing] evaluate () => typeof window.axe === 'object': 6ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 98ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 90ms
[test] [   2.30s] accessibility, tracking: aria-hidden-focus (serious, 1), color-contrast (serious, 8), html-has-lang (serious, 1)
[timing] scan: tracking: 766ms
[timing] goto http://127.0.0.1:8000/demo/freight/quote/?restart=1: 34ms
[timing] wait_for_load_state networkidle: 495ms
[timing] evaluate () => typeof window.axe === 'object': 5ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 95ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 59ms
[test] [   2.98s] accessibility, quote, step 1: aria-hidden-focus (serious, 1), color-contrast (serious, 9), html-has-lang (serious, 1)
[timing] scan: quote, step 1: 688ms
[timing] goto http://127.0.0.1:8000/demo/freight/login/: 31ms
[timing] wait_for_load_state networkidle: 491ms
[timing] evaluate () => typeof window.axe === 'object': 7ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 118ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 73ms
[test] [   3.71s] accessibility, staff sign-in: aria-hidden-focus (serious, 1), color-contrast (serious, 9), html-has-lang (serious, 1)
[timing] scan: staff sign-in: 721ms
[timing] goto http://127.0.0.1:8000/demo/freight/login/: 28ms
[timing] fill #username: 52ms
[timing] fill #password: 46ms
[timing] click #login-btn: 120ms
[timing] wait_for_selector #signed-in-user: 136ms
[test] [   4.09s] signed in as tester
[timing] goto http://127.0.0.1:8000/demo/freight/ops/: 146ms
[timing] wait_for_load_state networkidle: 436ms
[timing] evaluate () => typeof window.axe === 'object': 27ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 155ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 209ms
[test] [   5.06s] accessibility, staff dashboard: aria-hidden-focus (serious, 1), color-contrast (serious, 13), html-has-lang (serious, 1)
[timing] scan: staff dashboard: 973ms
[test] [   5.06s] report saved: a11y-report.html
[test] [   5.06s] FAILED: WCAG 2.1 AA: 4 rule(s) broken (details: a11y-report.html)
  - Elements must meet minimum color contrast ratio thresholds [color-contrast]: 58 on every page
  - ARIA hidden element must not be focusable or contain focusable elements [aria-hidden-focus]: 5 on every page
  - <html> element must have a lang attribute [html-has-lang]: 5 on every page
  - <svg> elements with an img or image role must have alternative text [svg-img-alt]: 1 on home page
[harness] security: 0 high, 1 medium, 1 low
[harness] saved failure.png
[harness] saved trace.zip
[harness] saved video.webm
[harness] result: failed

Security observations what the browser noticed while this ran — not a penetration test

Severity	Finding	What to do
medium	The application is served over plain HTTP http://127.0.0.1:8000/demo/ is not HTTPS, so anything typed into it travels the network in the clear and can be modified in transit.	On an isolated lab network this may be a deliberate choice -- if so, note it and move on. Anywhere else, terminate TLS in front of the application.
low	Response advertises software version (server) server: pw-testhub -- this tells an attacker exactly what to look up known vulnerabilities for.	Suppress or blank the server header at the proxy.
info	Cookie 'csrftoken' is readable by JavaScript (expected) This looks like a CSRF token, which the page's own JavaScript has to read in order to send it back. HttpOnly would break that. Nothing to do -- listed so you know it was checked and not missed.	No action. Do check that SESSION cookies are HttpOnly.

All of these appear together on the Security page.