Redirect back to primary URL not working with cy.origin and cy.session

[sksajjan]

Current behavior

The scenario is that, web application is hosted on server A, it uses keycloak SAML and that is hosted on server B (different domain). When the URL is accessed, it brings up Keycloak login page and on login with valid credentials, it navigates back to login page. Following is the code for login. Here, cy.url().should('contain', 'index.html#home') fails as it does not take user to Home page. The same exact code works fine on Firefox browser and does not work on any other browsers like chrome, electron and edge.

It appears to me that, the cookie is not being passed to the primary URL after login and hence, any further API calls to bring the home page will end in 401 return code and this appears to be leading to redirecting back to logout / login page. Or authorization itself not working within origin block and hence redirecting it back to login page. As this is working in firefox, and not on other chromium browsers, this appears to be some browser configuration issue. I have tried all options and examples provided in cypress documentation for cy.origin and cy.session() nothing actually work on all browsers.

Cypress.Commands.add('loginBySession', (userName, password) => {
  Cypress.on('uncaught:exception', (err, runnable) => {
    return false
  })
  const args = { userName, password }
  cy.session(args, () => {
    cy.visit(Cypress.env('webUrl'))

    cy.origin(Cypress.env('redirectDomain'), { args }, ({ userName, password }) => {
      cy.get('[name="username"]').should('be.visible')
      cy.get('[name="username"]').clear().type(userName)

      cy.get('[type="password"]').clear().type(password)
      cy.get('[name="login"],[id*="okta-signin-submit"]').click()
    })
    cy.url().should('contain', 'index.html#home')
  }).then(()=>{
    cy.visit(Cypress.env('webUrl'))
  })
})

Desired behavior

After clicking on login button, it should take control to home page and should not redirect back to the login page.

Test code to reproduce

Cypress.Commands.add('loginBySession', (userName, password) => {
  Cypress.on('uncaught:exception', (err, runnable) => {
    return false
  })
  const args = { userName, password }
  cy.session(args, () => {
    cy.visit(Cypress.env('webUrl'))

    cy.origin(Cypress.env('redirectDomain'), { args }, ({ userName, password }) => {
      cy.get('[name="username"]').should('be.visible')
      cy.get('[name="username"]').clear().type(userName)

      cy.get('[type="password"]').clear().type(password)
      cy.get('[name="login"],[id*="okta-signin-submit"]').click()
    })
    cy.url().should('contain', 'index.html#home')
  }).then(()=>{
    cy.visit(Cypress.env('webUrl'))
  })
})

Cypress Version

12.2.0

Node version

v18.12.1

Operating System

Windows 10 22H2 (OS build 19045.2364)

Debug Logs

CHROME LOGS

index-a9279392.js:99968 Console was cleared
index-a9279392.js:99961 Event:                    request
index-a9279392.js:99961 Resource type:            xhr
index-a9279392.js:99961 Method:                   GET
index-a9279392.js:99961 Url:                      https://kubeawsqa-dc1/app-gw/app/role/?_dc=1672134443191&page=1&start=0&limit=25
index-a9279392.js:99961 Request went to origin?:  yes
index-a9279392.js:99961 Request headers:          {sec-ch-ua: '"Not?A_Brand";v="8", "Chromium";v="108", "Google Chrome";v="108"', Referer: 'https://kubeawsqa-dc1/app-ui/index.html', X-Requested-With: 'XMLHttpRequest', sec-ch-ua-mobile: '?0', User-Agent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb…KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36', …}Referer: "https://kubeawsqa-dc1/app-ui/index.html"User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"X-Requested-With: "XMLHttpRequest"sec-ch-ua: "\"Not?A_Brand\";v=\"8\", \"Chromium\";v=\"108\", \"Google Chrome\";v=\"108\""sec-ch-ua-mobile: "?0"sec-ch-ua-platform: "\"Windows\""[[Prototype]]: Object

index-a9279392.js:99961 Response status code:     401

index-a9279392.js:99961 Response headers:         {date: 'Tue, 27 Dec 2022 09:47:23 GMT', strict-transport-security: 'max-age=31536000 ; includeSubDomains', x-content-type-options: 'nosniff', Content-Encoding: 'gzip', Vary: 'Accept-Encoding', …}Connection: "keep-alive"Content-Encoding: "gzip"Keep-Alive: "timeout=5"Transfer-Encoding: "chunked"Vary: "Accept-Encoding"cache-control: "private"content-type: "application/json;charset=UTF-8"date: "Tue, 27 Dec 2022 09:47:23 GMT"strict-transport-security: "max-age=31536000 ; includeSubDomains"x-content-type-options: "nosniff"x-xss-protection: "1; mode=block"[[Prototype]]: Object


FIREFOX logs

Console was cleared. index-a9279392.js:99968:50
Event:                    request index-a9279392.js:99961:13
Resource type:            xhr index-a9279392.js:99961:13
Method:                   GET index-a9279392.js:99961:13
Url:                      https://kubeawsqa-dc1/app-gw/app/role/ index-a9279392.js:99961:13
Request went to origin?:  yes index-a9279392.js:99961:13
Request headers:          
Object { host: "kubeawsqa-dc1", "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0", accept: "application/json, text/plain, */*", "accept-language": "en-US,en;q=0.5", "accept-encoding": "gzip, deflate, br", referer: "https://kubeawsqa-dc1/app-ui/", "content-type": "application/vnd.fico.app.v2.0+json;charset=UTF-8", "x-requested-with": "XMLHttpRequest", connection: "keep-alive", cookie: "JSESSIONID=18155531BF8700026F56ACAEE0643E8D; AWSALB=G+6zb6pcxvPvXNTZpHA2Kw6vspOO8EOny438FPsktI+DlU3gBzTONYKEqGza1DswoXASMpiTE0mzG/dW+19AFKmffEiK8isEg0uDWV36SupO84FtCPFlNwcSYWCA; AWSALBCORS=G+6zb6pcxvPvXNTZpHA2Kw6vspOO8EOny438FPsktI+DlU3gBzTONYKEqGza1DswoXASMpiTE0mzG/dW+19AFKmffEiK8isEg0uDWV36SupO84FtCPFlNwcSYWCA; app-user-id=1; app-tenant-id=1; AWSALB=dckJUMvxdE5cs5rKpLM+ozt30IyeLert7P1UqdrxA80MwqwjV5YJvGJh7uOz+co5x8osxrDYjl5T9N4dgJlFc0T0RuVqoi38w6wY148HaHAkvQxhMQ/ydxY/U+M/; AWSALBCORS=dckJUMvxdE5cs5rKpLM+ozt30IyeLert7P1UqdrxA80MwqwjV5YJvGJh7uOz+co5x8osxrDYjl5T9N4dgJlFc0T0RuVqoi38w6wY148HaHAkvQxhMQ/ydxY/U+M/; app-user-id=1; app-tenant-id=1" }
index-a9279392.js:99961:13
Response status code:     200 index-a9279392.js:99961:13
Response headers:         
Object { date: "Tue, 27 Dec 2022 09:48:32 GMT", "content-type": "application/vnd.fico.app.v2.0+json", "cache-control": "private", "strict-transport-security": "max-age=31536000 ; includeSubDomains", "x-xss-protection": "1; mode=block", "x-content-type-options": "nosniff", "set-cookie": "AWSALB=hzfZdti5RokNRsA48Wqb+/ce3UtvkewUW9rpCisnMeD+eQCddi9dEeHZn67X17JtqETtxMmnoOxglH4jwavBe0IT54iRkjEnO6f6Rz5RBDOxOqq8MH3pGJNMlfzw; Expires=Tue, 03 Jan 2023 09:48:32 GMT; Path=/\nAWSALBCORS=hzfZdti5RokNRsA48Wqb+/ce3UtvkewUW9rpCisnMeD+eQCddi9dEeHZn67X17JtqETtxMmnoOxglH4jwavBe0IT54iRkjEnO6f6Rz5RBDOxOqq8MH3pGJNMlfzw; Expires=Tue, 03 Jan 2023 09:48:32 GMT; Path=/; SameSite=None; Secure", vary: "Accept-Encoding", "content-encoding": "gzip", connection: "keep-alive", … }
index-a9279392.js:99961:13

GET /app-gw/ HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cache-Control: max-age=0
Connection: keep-alive
Cookie: JSESSIONID=1576D9FCDEA11B22781B4B4555173528; _saml_idp="aHR0cHM6Ly9kbXBzYXV0b21hdGlvbjA4LnVzZWFzdDEtZndzLmZpY29hbmFseXRpY2Nsb3VkLmNvbTo4NDQzL09wZW5BTQ=="
Host: appautoregression02.useast1-fws.ficoanalyticcloud.com:8443
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108", "Google Chrome";v="108"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"

Other

No response

[sksajjan]

Please note, I have also tried to use the examples for okta login from following page by creating a javascript function for login as depicted in this page https://docs.cypress.io/guides/end-to-end-testing/okta-authentication#Login-with-cy-origin however, this did not help too.

[emilyrohrbough]

@sksajjan Can you verify the same / all cookies have been set/sent with the login request when you compare firefox to chorme? It seems something (likely a cookie) is missing which is causing the re-direct back to the login page. There are two known cookie issues -- one calling out key-cloak and want to verify if you are seeing the same behavior or something else.

• Redirects do not honor set-cookie header #20476
• Avoid creating cookie prepended with dot ('.') #25174 (calls out keycloak)

[sksajjan]

@emilyrohrbough I have looked at both issues and they may seem to be related but I cannot confirm for sure. I have tried the workaround provided in #20476 and that did not help in my case.

  cy.intercept(Cypress.env('webUrl'), (req) => {
    req.continue((res) => {
      const value = res.headers['set-cookie'];
      const setCookie = Array.isArray(value) ? value : [value];
      res.headers['set-cookie'] = setCookie.map((value) =>
        value.replace(/ ?Secure;?/, '').replace(/ ?SameSite=None;?/, '')
      );
    });
  });

I have attached chrome and firefox comparison as the test executes to create a session. I do see lot of errors being shown in the console when keycloak url is accessed. I have tried to add Access-Control-Allow-Origin to the base url and that did not help too. It takes a very long time to even hit the APIs and finally, it times out

RequestAndResponseDuringSessionCreation.log

cy.intercept("Cypress.env('webUrl')", (req)=>{
    req.headers['Access-Control-Allow-Origin'] = Cypress.env('redirectDomain')
  })

[AtofStryker]

@sksajjan any idea if we might be able to reproduce this with the keycloak docker image, kind of like in this other reproduction repository with the SAML config?

[sksajjan]

@AtofStryker I will get back to you on this. We were able to use redirect for OKTA login successfully and still having issue with Keycloak. Please keep this issue open until some more time.

[mschile]

Unfortunately we have to close this issue due to inactivity. Please comment if there is new information to provide concerning the original issue and we can reopen.