Origin never changes back on 302 redirect

[xaviergmail]

Current behavior

When the page of baseUrl redirects to another origin immediately via HTTP 302 for external login, Cypress changes the top level origin to that other domain and remains there. This causes issues for the rest of our tests, and wrapping all of our existing tests in cy.origin() is not an adequate solution.

Desired behavior

Cypress should not do this and instead keep the top level origin the same as the provided baseURL, provide a way to configure a static origin, or allow for the origin to be changed inside a before() hook or another type of event.

Test code to reproduce

The easiest way to reproduce is to create a sample GitHub pages repository and set its visibility to private.

Use the following command to log into a dummy GitHub user with access to view the page:

Cypress.Commands.add('loginToGithubPages', (domain) => {
  const username = require_env('GITHUB_PAGES_USERNAME')
  const password = require_env('GITHUB_PAGES_PASSWORD')

  // View `e2e-tests/docs/github-pages-auth.md` for instructions on how to get this
  const totp_secret = require_env('GITHUB_PAGES_TOTP_SECRET')

  cy.url().should('include', 'github.com/login')
  cy.get('#login_field').clear()
  cy.get('#login_field').type(username)
  cy.get('#password').clear()
  cy.get('#password').type(password)
  cy.get('input[name="commit"]').click()
  cy.get('#app_totp').clear()

  const totp = authenticator.generate(totp_secret)
  cy.get('#app_totp').type(totp)
  cy.get('#app_totp')
    .should('not.exist')
    .then(() => {
      const decline_form = 'form[action="/sessions/trusted-device/decline?hard=true"]'
      if (Cypress.$(decline_form).length > 0) {
        cy.get(decline_form).submit()
      }
    })
  // It auto-submits when typing (at least at the time of writing)

Cypress Version

12.7.4

Node version

16.20.2

Operating System

macOS 14.1.1

Debug Logs

I am unable to release debug logs publicly as they may contain sensitive information but am happy to provide them in private.

Other

No response

[jennifer-shehane]

@xaviergmail Wouldn't you be able to do the following?

cy.visit('mywebsite.pages.github.io')
// on reroute, the page goes into origin code for login
cy.origin('github.com', () => {
  cy.loginToGithubPages()
})
// run all commands on the main site you want to test here. 

[xaviergmail]

I have tried that and it unfortunately does not work, seeing as the redirect happens on the initial page load when starting Cypress (before any cy.visit()s occur). My wild uneducated guess is that the first page interaction that occurs changes the origin. I see my other before()/beforeEach() hooks run in the task output side panel, then the headed Cypress window does a full reload and that's when the origin gets changed.

[MarkiyanPyts]

I have the same issue

[cypress-app-bot]

This issue has not had any activity in 180 days. Cypress evolves quickly and the reported behavior should be tested on the latest version of Cypress to verify the behavior is still occurring. It will be closed in 14 days if no updates are provided.

[cypress-app-bot]

This issue has been closed due to inactivity.

[Kenneth-Mano]

Hi,

I am experiencing the same issue as well.

Is there a workaround of some sort? Or can this be reopened and prioritised? It's pretty common for logins to do 302 redirections, so I imagine it's frequently encountered by others

Thanks

[TimGodschalck]

We encountered the same issue when logging in via Office. I was able to resolve it using a variation of @jennifer-shehane's solution:

    cy.origin("URL_TO_APP",
        () => {
            cy.visit("URL_TO_APP");
        });

    cy.window().then(() => {
      //needed for the check
        cy.wait(4000);
        cy.get("body")
            .then($body => {
          		//check if user already is logged-in
                if ($body.find("#bannerLogo").length > 0) {
                    cy.origin("https://login.microsoftonline.com",
                        () => {
                            // wait for manual login
                            cy.wait(<loginWaitDuration>);
                        }
                    );
                } else {
                    cy.origin("URL_TO_APP", () => {
                        cy.get("element").should("be.visible");
                    });
                }
            });
    });

This solution required the user to log in manually due to the necessity of authenticator verification. The flow starts by navigating to the app, which then redirects to the Office login.

It's not the most elegant approach, but it worked for us. Hope this helps! 🚀