fix: Make cross-origin document.cookie work #22594
Conversation
|
Thanks for taking the time to open a PR!
|
|
Test summary
Run details
View run in Cypress Dashboard ➡️ Flakiness
This comment has been generated by cypress-bot as a result of this project's GitHub integration settings. You can manage this integration in this project's settings in the Cypress Dashboard |
||||||||||||||||||||||||||||||||||||||||||||||||||
| done() | ||
| }) | ||
|
|
||
| cy.get('[data-cy="welcome"]').as('welcome_button') | ||
| cy.get('[data-cy="cross-origin-secondary-link"]').as('link') |
There was a problem hiding this comment.
I removed the element with data-cy="welcome" since it wasn't referenced elsewhere, so I had to update this test.
There was a problem hiding this comment.
Verified this works with #22568 to support microsoftonline and login.live.com which I think closes #21307 🎉
| @@ -40,6 +41,8 @@ const findCypress = () => { | |||
|
|
|||
| const Cypress = findCypress() | |||
|
|
|||
| patchDocumentCookie(Cypress) | |||
There was a problem hiding this comment.
would it be valuable to patch this in a non-cy.origin use case? It seems like it might be if it makes document.cookie behave more like as if the AUT is top.
There was a problem hiding this comment.
It's only an issue if the top origin doesn't match the AUT origin, so it's not necessary in other cases.
|
|
||
| // fixes tough-cookie defaulting undefined/invalid SameSite to 'none' | ||
| // https://github.com/salesforce/tough-cookie/issues/191 | ||
| const hasUnspecifiedSameSite = toughCookie.sameSite === 'none' && !sameSiteNoneRe.test(cookie) |
There was a problem hiding this comment.
Should we consider contributing this fix to toughCookie? Is this something other people would want too?
There was a problem hiding this comment.
Looks like they already have a PR to fix it: salesforce/tough-cookie#240
…ypress into issue-22479-document-cookie
User facing changelog
document.cookieworks when testing multiple originsHow has the user experience changed?
Previously, some authentication providers that rely on
document.cookiewould not function correctly because it behaves differently when used in an iframe (the AUT) that has a different origin than top. This PR fixes issues withdocument.cookie, making it behave as if the user's app is being run in top.PR Tasks
cypress-documentation?type definitions?