cypress-io · chrisbreiding · Mar 22, 2022 · Feb 28, 2022 · Feb 28, 2022 · Feb 28, 2022
diff --git a/packages/driver/cypress/fixtures/auth/cookie-login.html b/packages/driver/cypress/fixtures/auth/cookie-login.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+ <select data-cy="sameSite">
+ <option value="">Empty</option>
+ <option value="None">None</option>
+ <option value="Lax">Lax</option>
+ <option value="Strict">Strict</option>
+ <option value="Invalid">Invalid</option>
+ </select>
+ <label>
+ <input type="checkbox" data-cy="secure" /> Secure
+ </label>
+ <label for="name">Username: </label>
+ <input data-cy="username" type="text" required>
+ <button data-cy="login">Login</button>
+
+ <script>
+ document.querySelector('[data-cy="login"]').addEventListener('click', () => {
+ const queryString = window.location.search;
+ const urlParams = new URLSearchParams(queryString);
+ const redirect = urlParams.get('redirect')
+ const username = document.querySelector('[data-cy=username]').value
+ const sameSite = document.querySelector('[data-cy=sameSite]').value
+ const secure = document.querySelector('[data-cy=secure]').checked
+ let url = `https://www.foobar.com:3502/cookie-login?redirect=${redirect}&username=${username}`
+
+ if (sameSite) {
+ url += `&sameSite=${sameSite}`
+ }
+
+ if (secure) {
+ url += `&secure=true`
+ }
+
+ window.location.href = url
+ })
+ </script>
+</body>
+</html>
diff --git a/packages/driver/cypress/fixtures/multi-domain.html b/packages/driver/cypress/fixtures/multi-domain.html
@@ -19,6 +19,8 @@
  <a data-cy="files-form-link" href="http://www.foobar.com:3500/fixtures/files-form.html">http://www.foobar.com:3500/fixtures/files-form.html</a>
  <a data-cy="errors-link" href="http://www.foobar.com:3500/fixtures/errors.html">http://www.foobar.com:3500/fixtures/errors.html</a>
  <a data-cy="screenshots-link" href="http://www.foobar.com:3500/fixtures/screenshots.html">http://www.foobar.com:3500/fixtures/screenshots.html</a>
+ <a data-cy="cookie-login" href="http://www.foobar.com:3500/fixtures/auth/cookie-login.html?redirect=http://localhost:3500/login">Login with Social</a>
+ <a data-cy="welcome" href="http://localhost:3500/welcome">Go to Welcome</a>
  </div>
 </body>
 </html>
diff --git a/packages/driver/cypress/integration/e2e/multi-domain/cookie_login_spec.ts b/packages/driver/cypress/integration/e2e/multi-domain/cookie_login_spec.ts
@@ -0,0 +1,96 @@
+// @ts-ignore / session support is needed for visiting about:blank between tests
+describe('multi-domain - cookie login', { experimentalSessionSupport: true }, () => {
+ const verifyLoggedIn = (username) => {
+ cy.get('h1')
+ .invoke('text')
+ .should('equal', `Welcome, ${username}!`)
+ }
+
+ it('works in a session', () => {
+ cy.session('ZJohnson', () => {
+ cy.visit('/fixtures/multi-domain.html')
+ cy.get('[data-cy="cookie-login"]').click()
+ cy.switchToDomain('http://foobar.com:3500', () => {
+ cy.get('[data-cy="username"]').type('ZJohnson')
+ cy.get('[data-cy="login"]').click()
+ })
+ }, {
+ validate () {
+ cy.getCookie('user').its('value').should('equal', 'ZJohnson')
+ },
+ })
+
+ cy.visit('/welcome')
+ verifyLoggedIn('ZJohnson')
+ })
+
+ describe('SameSite handling', () => {
+ beforeEach(() => {
+ cy.visit('/fixtures/multi-domain.html')
+ cy.get('[data-cy="cookie-login"]').click()
+ })
+
+ it('works with no SameSite, no Secure', () => {
+ cy.switchToDomain('http://foobar.com:3500', () => {
+ cy.get('[data-cy="username"]').type('AJohnson')
+ cy.get('[data-cy="login"]').click()
+ })
+
+ verifyLoggedIn('AJohnson')
+ })
+
+ it('works with SameSite=None, Secure', () => {
+ cy.switchToDomain('http://foobar.com:3500', () => {
+ cy.get('[data-cy="sameSite"]').select('None')
+ cy.get('[data-cy="secure"]').check()
+ cy.get('[data-cy="username"]').type('BJohnson')
+ cy.get('[data-cy="login"]').click()
+ })
+
+ verifyLoggedIn('BJohnson')
+ })
+
+ it('works with SameSite=None, no Secure', () => {
+ cy.switchToDomain('http://foobar.com:3500', () => {
+ cy.get('[data-cy="sameSite"]').select('None')
+ cy.get('[data-cy="username"]').type('CJohnson')
+ cy.get('[data-cy="login"]').click()
+ })
+
+ verifyLoggedIn('CJohnson')
+ })
+
+ it('works with SameSite=Lax, Secure', () => {
+ cy.switchToDomain('http://foobar.com:3500', () => {
+ cy.get('[data-cy="sameSite"]').select('Lax')
+ cy.get('[data-cy="secure"]').check()
+ cy.get('[data-cy="username"]').type('DJohnson')
+ cy.get('[data-cy="login"]').click()
+ })
+
+ verifyLoggedIn('DJohnson')
+ })
+
+ it('works with SameSite=Strict, Secure', () => {
+ cy.switchToDomain('http://foobar.com:3500', () => {
+ cy.get('[data-cy="sameSite"]').select('Strict')
+ cy.get('[data-cy="secure"]').check()
+ cy.get('[data-cy="username"]').type('EJohnson')
+ cy.get('[data-cy="login"]').click()
+ })
+
+ verifyLoggedIn('EJohnson')
+ })
+
+ it('works with invalid SameSite, Secure', () => {
+ cy.switchToDomain('http://foobar.com:3500', () => {
+ cy.get('[data-cy="sameSite"]').select('Invalid')
+ cy.get('[data-cy="secure"]').check()
+ cy.get('[data-cy="username"]').type('FJohnson')
+ cy.get('[data-cy="login"]').click()
+ })
+
+ verifyLoggedIn('FJohnson')
+ })
+ })
+})
diff --git a/packages/driver/cypress/plugins/server.js b/packages/driver/cypress/plugins/server.js
@@ -10,7 +10,6 @@ const multer = require('multer')
 const upload = multer({ dest: 'cypress/_test-output/' })
 
 const PATH_TO_SERVER_PKG = path.dirname(require.resolve('@packages/server'))
-const { getPathToDist } = require('@packages/resolve-dist')
 
 const httpPorts = [3500, 3501]
 const httpsPort = 3502
@@ -27,6 +26,7 @@ const createApp = (port) => {
  })
 
  app.use(require('cors')())
+ app.use(require('cookie-parser')())
  app.use(require('compression')())
  app.use(bodyParser.urlencoded({ extended: false }))
  app.use(bodyParser.json())
@@ -190,9 +190,67 @@ const createApp = (port) => {
  .send('<html><body>server error</body></html>')
  })
 
- app.get('/cypress_multi_domain_runner.js', (req, res) => {
- res.type('application/javascript')
- res.sendFile(getPathToDist('runner', 'cypress_multi_domain_runner.js'))
+ const getCookieAdditions = ({ sameSite, secure }) => {
+ let additions = ''
+
+ if (sameSite) additions += `; SameSite=${sameSite}`
+
+ if (secure) additions += '; Secure'
+
+ return additions
+ }
+
+ app.get('/cookie-login', (req, res) => {
+ const { username, redirect } = req.query
+
+ res
+ .header('Set-Cookie', `user=${username}${getCookieAdditions(req.query)}`)
+ .redirect(302, `/verify-cookie-login?username=${username}&redirect=${redirect}`)
+ })
+
+ app.get('/verify-cookie-login', (req, res) => {
+ if (!req.cookies.user) {
+ return res
+ .status(403)
+ .send('<html><body><h1>Not logged in</h1></body></html>')
+ }
+
+ const { username, redirect } = req.query
+
+ res.send(`
+ <html>
+ <body>
+ <h1>Redirecting ${username}...</h1>
+ <script>
+ setTimeout(() => {
+ window.location.href = '${redirect}?username=${username}'
+ }, 1000)
+ </script>
+ </body>
+ </html>
+ `)
+ })
+
+ app.get('/login', (req, res) => {
+ const { username } = req.query
+
+ if (!username) {
+ return res.send('<html><body><h1>Must specify username to log in</h1></body></html>')
+ }
+
+ // can't use res.cookie() because it won't allow setting an invalid
+ // SameSite value, which we want to test
+ res
+ .header('Set-Cookie', `user=${username}${getCookieAdditions(req.query)}`)
+ .redirect(302, '/welcome')
+ })
+
+ app.get('/welcome', (req, res) => {
+ if (!req.cookies.user) {
+ return res.send('<html><body><h1>No user found</h1></body></html>')
+ }
+
+ res.send(`<html><body><h1>Welcome, ${req.cookies.user}!</h1></body></html>`)
  })
 
  let _var = ''

diff --git a/packages/driver/package.json b/packages/driver/package.json
@@ -45,6 +45,7 @@
  "chokidar-cli": "2.1.0",
  "clone": "2.1.2",
  "compression": "1.7.4",
+ "cookie-parser": "1.4.5",
  "core-js-pure": "3.21.0",
  "cors": "2.8.5",
  "cypress-multi-reporters": "1.4.0",

diff --git a/packages/driver/src/cypress/cy.ts b/packages/driver/src/cypress/cy.ts
@@ -936,9 +936,6 @@ export class $Cy extends EventEmitter2 implements ITimeouts, IStability, IAssert
  // TODO: handle no longer error when ended early
  cy.doneEarly()
 
- // if using multi-domain, unbind any listeners waiting for a done() callback to come from cross domain
- // @ts-ignore
- Cypress.multiDomainCommunicator.emit('unbind:done:called')
  originalDone(err)
 
  // return null else we there are situations

diff --git a/packages/network/lib/cors.ts b/packages/network/lib/cors.ts
@@ -84,6 +84,15 @@ export function urlMatchesOriginPolicyProps (urlStr, props) {
  return _.isEqual(parsedUrl, props)
 }
 
+export function urlOriginsMatch (url1, url2) {
+ if (!url1 || !url2) return false
+
+ const parsedUrl1 = parseUrlIntoDomainTldPort(url1)
+ const parsedUrl2 = parseUrlIntoDomainTldPort(url2)
+
+ return _.isEqual(parsedUrl1, parsedUrl2)
+}
+
 export function urlMatchesOriginProtectionSpace (urlStr, origin) {
  const normalizedUrl = uri.addDefaultPort(urlStr).format()
  const normalizedOrigin = uri.addDefaultPort(origin).format()

diff --git a/packages/network/lib/uri.ts b/packages/network/lib/uri.ts
@@ -6,7 +6,7 @@
 // - https://nodejs.org/api/url.html#url_url_format_urlobject
 
 import _ from 'lodash'
-import url from 'url'
+import url, { URL } from 'url'
 
 // yup, protocol contains a: ':' colon
 // at the end of it (-______________-)
@@ -87,3 +87,15 @@ export function addDefaultPort (urlToCheck) {
 export function getPath (urlToCheck) {
  return url.parse(urlToCheck).path
 }
+
+const localhostIPRegex = /^127(?:\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}$/
+
+export function isLocalhost (url: URL) {
+ return Boolean(
+ url.hostname === 'localhost'
+ // [::1] is the IPv6 localhost address.
+ || url.hostname === '[::1]'
+ // 127.0.0.0/8 are considered localhost for IPv4.
+ || url.hostname.match(localhostIPRegex),
+ )
+}
diff --git a/packages/network/test/unit/uri_spec.ts b/packages/network/test/unit/uri_spec.ts
@@ -0,0 +1,40 @@
+import { expect } from 'chai'
+import { URL } from 'url'
+
+import { uri } from '../../lib'
+
+describe('lib/uri', () => {
+ context('.isLocalhost', () => {
+ it('http://localhost is localhost', () => {
+ expect(uri.isLocalhost(new URL('http://localhost'))).to.be.true
+ })
+
+ it('https://localhost is localhost', () => {
+ expect(uri.isLocalhost(new URL('https://localhost'))).to.be.true
+ })
+
+ it('http://127.0.0.1 is localhost', () => {
+ expect(uri.isLocalhost(new URL('http://127.0.0.1'))).to.be.true
+ })
+
+ it('http://127.0.0.9 is localhost', () => {
+ expect(uri.isLocalhost(new URL('http://127.0.0.9'))).to.be.true
+ })
+
+ it('http://[::1] is localhost', () => {
+ expect(uri.isLocalhost(new URL('http://[::1]'))).to.be.true
+ })
+
+ it('http://128.0.0.1 is NOT localhost', () => {
+ expect(uri.isLocalhost(new URL('http://128.0.0.1'))).to.be.false
+ })
+
+ it('http:foobar.com is NOT localhost', () => {
+ expect(uri.isLocalhost(new URL('http:foobar.com'))).to.be.false
+ })
+
+ it('https:foobar.com is NOT localhost', () => {
+ expect(uri.isLocalhost(new URL('https:foobar.com'))).to.be.false
+ })
+ })
+})