Cookie behavior issue after 10.3.0

[lehmat]

Current behavior

localhost cookies are not sent on separate ports. In example we have the following setup:

Frontend -> localhost:5000
API -> localhost:5002
OAUTH2 -> localhost:5005

The frontend does not send cookies to API after 10.3.0 (see flow in extra information).

Desired behavior

Frontend should be sending API cookies as normal

Test code to reproduce

N/A

Cypress Version

10.3.0

Other

[karlhorky]

@lehmat are you sure that this happens on 10.3.1? I'm seeing something similar, but only starting on 10.4.0...

[karlhorky]

Wonder if the latest cross-origin cookie changes in the 10.4.0 changelog could be related:

PR #22963: Fixes issue where cookies were not handled within cy.origin for requests other than the AUT page request. Fixes #22952 & #21474.

PR #22963 by @mschile , approved by @mjhenkes @AtofStryker @chrisbreiding @emilyrohrbough

---

To be clear our code / tests with localhost cookies on multiple ports was NOT having problems with 10.3.1, even though in the changelog entry for 10.3.1, there was a change pertaining to cross-origin cookie work.

[AtofStryker]

Hi @lehmat. Thank you for opening an issue. Was this behavior working in 10.2.0 and just broke in 10.3.0? We did make some large cookie changes in #20685 that released in 10.3.0. Are you able to provide a reproduction, maybe something that runs on a few services on localhost ports we can spin up with a few dev servers to see what is happening with the cookies?

What I think would make more sense is what @karlhorky has said here. 10.4.0 mostly pertains to attaching cookies to XHR/Fetch resources besides just Document resources with the experimentalSessionAndOrigin flag on when cross origin comes into play. Though I have a hunch as to what might be happening. The API calls you are using to broker OAuth2 flow were not being classified as isAUTFrame and are XHR/Fetch requests, which means the Set-Cookie header was being used in 10.3.1. Now that IsAUTFrame is no longer required in the check, I have a feeling checkIfNeedsCrossOriginHandling is evaluating to true because cors.urlOriginsMatch treats different ports as a origin mismatch. This means X-Set-Cookie is being used, when it likely shouldn't be. Whether this is causing your issue or not, I am fairly convinced this is a bug, and removing the isAUTFrame check exposed this.

Would you be able to confirm a few things for me. Can you run your Cypress test with DEBUG=cypress-verbose:proxy:http set, like DEBUG=cypress-verbose:proxy:http yarn cypress open? I would need you to do this twice, once in 10.3.1 and once in 10.4.0. This would confirm the X-Set-Cookie vs Set-Cookie belief, further proving this is an issue.

[karlhorky]

One thing that I can confirm already now is that in my case, the cookies are not being set (the Application tab in Chrome confirms that no cookie has been set).

My environment:

• localhost:3010 - API (Express) <-- sets the cookie on domain localhost in /login response
• localhost:3020 - frontend web service (Next.js) <-- no cookie observed, login fails
• no OAuth flow or iframe or anything

Cypress 10.3.1 works, 10.4.0 fails.

[AtofStryker]

One thing that I can confirm already now is that in my case, the cookies are not being set (the Application tab in Chrome confirms that no cookie has been set).

My environment:

• localhost:3020 - frontend web service (Next.js)
• localhost:3010 - API (Express)
• no OAuth flow or iframe or anything

Cypress 10.3.1 works, 10.4.0 fails.

Seems suspect. Let me know when you are able to run with the debug flags!

[karlhorky]

I've updated the post above to be clear that the API (localhost:3010) is setting the cookie on localhost in the response from the /login API call, which starting with 10.4.0 is no longer being observed by the frontend (localhost:3020).

My hypothesis earlier today while I was looking at it was that the updated cross-origin handling of cookies that Cypress added is now treating localhost:3010 and localhost:3020 as different origins / domains for cookies - which does not match the behavior of browsers, nor RFC 6265:

Similarly, cookies for a given host are shared across all the ports on that host, even though the usual "same-origin policy" used by web browsers isolates content retrieved via different ports.

Cookies do not provide isolation by port.

[AtofStryker]

I've updated the post above to be clear that the API (localhost:3010) is setting the cookie on localhost in the response from the /login API call, which starting with 10.4.0 is no longer being observed by the frontend (localhost:3020).

My hypothesis earlier today while I was looking at it was that the updated cross-origin handling of cookies that Cypress added is now treating localhost:3010 and localhost:3020 as different origins / domains for cookies - which does not match the behavior of browsers, nor RFC 6265:

Similarly, cookies for a given host are shared across all the ports on that host, even though the usual "same-origin policy" used by web browsers isolates content retrieved via different ports.

Cookies do not provide isolation by port.

Not sure if my response was unclear but this is what is being said in #23132 (comment). The debug logs should verify this issue via X-Set-Cookie vs Set-Cookie, which means we can route this to a team and hopefully release a patch soon.

[karlhorky]

Below is what came back from running Cypress 10.4.0 with DEBUG=cypress-verbose:proxy:http . Maybe the second to last line is relevant.

  cypress-verbose:proxy:http POST http://localhost:3010/login IncomingRequest proxying request { req: { method: 'POST', proxiedUrl: 'http://localhost:3010/login', headers: { host: 'localhost:3010', 'proxy-connection': 'keep-alive', 'content-length': '143', 'sec-ch-ua': '"Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"', accept: 'application/json, text/plain, */*', 'content-type': 'application/json', 'sec-ch-ua-mobile': '?0', 'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36', 'sec-ch-ua-platform': '"macOS"', origin: 'http://localhost:3020', 'sec-fetch-site': 'same-site', 'sec-fetch-mode': 'cors', 'sec-fetch-dest': 'empty', referer: 'http://localhost:3020/', 'accept-encoding': 'gzip, deflate, br', 'accept-language': 'en-US,en;q=0.9' } } } +4ms
  cypress-verbose:proxy:http POST http://localhost:3010/login IncomingRequest existing cookies on request:  +0ms
  cypress-verbose:proxy:http POST http://localhost:3010/login IncomingRequest add cookies to request:  +0ms
  cypress-verbose:proxy:http POST http://localhost:3010/login IncomingRequest waiting for prerequest +0ms
  cypress-verbose:proxy:http POST http://localhost:3010/login IncomingRequest Incoming request POST-http://localhost:3010/login matches known pre-request: { requestId: '61976.132', method: 'POST', url: 'http://localhost:3010/login', headers: { 'sec-ch-ua': '"Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"', Accept: 'application/json, text/plain, */*', Referer: 'http://localhost:3020/', 'Content-Type': 'application/json', 'sec-ch-ua-mobile': '?0', 'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36', 'sec-ch-ua-platform': '"macOS"' }, resourceType: 'xhr', originalResourceType: 'XHR' } +0ms
  cypress-verbose:proxy:http POST http://localhost:3010/login IncomingResponse received response { req: { method: 'POST', proxiedUrl: 'http://localhost:3010/login', headers: { host: 'localhost:3010', 'proxy-connection': 'keep-alive', 'content-length': '143', 'sec-ch-ua': '"Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"', accept: 'application/json, text/plain, */*', 'content-type': 'application/json', 'sec-ch-ua-mobile': '?0', 'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36', 'sec-ch-ua-platform': '"macOS"', origin: 'http://localhost:3020', 'sec-fetch-site': 'same-site', 'sec-fetch-mode': 'cors', 'sec-fetch-dest': 'empty', referer: 'http://localhost:3020/', 'accept-encoding': 'gzip', 'accept-language': 'en-US,en;q=0.9' } }, incomingRes: { headers: { 'x-powered-by': 'Express', 'access-control-allow-origin': 'http://localhost:3020', vary: 'Origin', 'access-control-allow-credentials': 'true', 'set-cookie': [Array], 'content-type': 'application/json; charset=utf-8', 'content-length': '386', etag: 'W/"182-gwaI9oJ8sMNoXrEIGqSDwgdpAoY"', date: 'Fri, 05 Aug 2022 23:12:12 GMT', connection: 'keep-alive', 'keep-alive': 'timeout=5' }, statusCode: 201 } } +266ms
  cypress-verbose:proxy:http POST http://localhost:3010/login IncomingResponse ensuring resStream is plaintext +0ms
  cypress-verbose:proxy:http POST http://localhost:3010/login IncomingResponse determine injection +1ms
  cypress-verbose:proxy:http POST http://localhost:3010/login IncomingResponse - no injection (not html) +0ms
  cypress-verbose:proxy:http POST http://localhost:3010/login IncomingResponse injection levels: { isInitial: false, wantsInjection: false, wantsSecurityRemoved: false } +0ms
  cypress-verbose:proxy:http POST http://localhost:3010/login IncomingResponse adding cookie to jar failed: Cookie is SameSite but this is a cross-origin request +1ms
POST /login 201 268.699 ms - -

[lehmat]

Hi,

We found this issue on first on 10.3.0 and it has not been fixed in the later releases. Below are logs from the DEBUG option requested.

Are you able to provide a reproduction, maybe something that runs on a few services on localhost ports we can spin up with a few dev servers to see what is happening with the cookies?

Unfortunately no

• 10.2.0

  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingRequest proxying request { req: { method: 'GET', proxiedUrl: 'http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a4192c8170511ed86e00242ac12000a', headers: { host: 'localhost:5005', 'proxy-connection': 'keep-alive', accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9', 'accept-encoding': 'gzip, deflate, br', 'accept-language': 'en-GB', cookie: 'vuex-cookie; __cypress.initial=true', referer: 'http://localhost:5001/', 'sec-fetch-dest': 'iframe', 'sec-fetch-mode': 'navigate', 'sec-fetch-site': 'same-site', 'upgrade-insecure-requests': '1', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.2.0 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36', 'x-cypress-is-aut-frame': 'true' } } } +14ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingRequest waiting for prerequest +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingRequest matches pending pre-request { requestId: '2DA6F90A0DC45AA7CF2455DB34647D0C', method: 'GET', url: 'http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a4192c8170511ed86e00242ac12000a', headers: { Referer: 'http://localhost:5001/', 'Upgrade-Insecure-Requests': '1', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.2.0 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36' }, resourceType: 'other', originalResourceType: 'Document' } +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingResponse received response { req: { method: 'GET', proxiedUrl: 'http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a4192c8170511ed86e00242ac12000a', headers: { host: 'localhost:5005', 'proxy-connection': 'keep-alive', accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9', 'accept-encoding': 'gzip', 'accept-language': 'en-GB', cookie: 'vuex-cookie; __cypress.initial=true', referer: 'http://localhost:5001/', 'sec-fetch-dest': 'iframe', 'sec-fetch-mode': 'navigate', 'sec-fetch-site': 'same-site', 'upgrade-insecure-requests': '1', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.2.0 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36' } }, incomingRes: { headers: { server: 'Werkzeug', date: 'Mon, 08 Aug 2022 10:33:28 GMT', 'content-type': 'text/html; charset=utf-8', 'content-length': '251', location: 'http://localhost:5000/', 'cache-control': 'max-age=0, private, no-cache, no-store, must-revalidate, proxy-revalidate, no-transform', pragma: 'no-cache', expires: 'Mon, 08 Aug 2022 10:33:27 GMT', 'access-control-allow-origin': 'http://localhost:5000', 'access-control-allow-credentials': 'true', 'access-control-allow-methods': 'POST, DELETE, PATCH, PUT, GET, OPTIONS', 'access-control-allow-headers': 'Sentry-Trace, Accept, X-Api-Key, X-Amz-Date, X-Amz-Security-Token, X-Amz-User-Agent, X-CSRFToken, X-auth/csrftoken-Translate, Content-Type, Baggage, Authorization', 'access-control-expose-headers': '*', 'access-control-max-age': '600', 'x-content-type-options': 'nosniff', 'strict-transport-security': 'max-age=31536000; includeSubdomains;', 'expect-ct': 'max-age=0', vary: 'Cookie', 'set-cookie': [Array], connection: 'close' }, statusCode: 307 } } +771ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingResponse is cross-origin, delay until cross:origin:release:html event +1ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingResponse received cross:origin:release:html, let the response proceed +305ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingResponse determine injection +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingResponse - full injection +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingResponse injection levels: { isInitial: true, wantsInjection: 'full', wantsSecurityRemoved: false } +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingResponse force SameSite=None? true +1ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingResponse original cookie: session=.eJwlzjuOAzEIANC7uN6R-BhscpkIDFa2nWyqVe6ekdK_4v23-z7r-Wi3v_NVP-3-m-3WWEnVhQZbOqOVoHdC12GRGEx7bLKRfQl12-4LWGMH6qpZU2PqZqRdTlNmgphyUeIljAZtFAlnCY5gXcYTFoKaU2afpN6uyOtZ53fTAy7ndeAAORArj4lKB1AnX0gAoO39AX5zNyg.YvDmeA.5Xw4nPrnWkyV6hy8L41GOKB4QsM; HttpOnly; Path=/ +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingResponse add SameSite=None to cookie +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingResponse add Secure to cookie +1ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingResponse resulting cookie: session=.eJwlzjuOAzEIANC7uN6R-BhscpkIDFa2nWyqVe6ekdK_4v23-z7r-Wi3v_NVP-3-m-3WWEnVhQZbOqOVoHdC12GRGEx7bLKRfQl12-4LWGMH6qpZU2PqZqRdTlNmgphyUeIljAZtFAlnCY5gXcYTFoKaU2afpN6uyOtZ53fTAy7ndeAAORArj4lKB1AnX0gAoO39AX5zNyg.YvDmeA.5Xw4nPrnWkyV6hy8L41GOKB4QsM; HttpOnly; Path=/; SameSite=None; Secure +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=tNgQx50eIbqzOxgt&code=8a41... IncomingResponse redirecting to new url { statusCode: 307, newUrl: 'http://localhost:5000/' } +0ms


  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingRequest proxying request { req: { method: 'GET', proxiedUrl: 'http://localhost:5005/auth/csrftoken', headers: { host: 'localhost:5005', 'proxy-connection': 'keep-alive', accept: 'application/json', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.2.0 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36', 'sec-fetch-site': 'same-site', 'sec-fetch-mode': 'cors', 'sec-fetch-dest': 'empty', referer: 'http://localhost:5000/', 'accept-encoding': 'gzip, deflate, br', 'accept-language': 'en-GB', cookie: 'vuex-cookie' } } } +17ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingRequest waiting for prerequest +1ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingRequest matches pending pre-request { requestId: '20804.123', method: 'GET', url: 'http://localhost:5005/auth/csrftoken', headers: { Accept: 'application/json', Referer: 'http://localhost:5000/', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.2.0 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36' }, resourceType: 'xhr', originalResourceType: 'XHR' } +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingResponse received response { req: { method: 'GET', proxiedUrl: 'http://localhost:5005/auth/csrftoken', headers: { host: 'localhost:5005', 'proxy-connection': 'keep-alive', accept: 'application/json', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.2.0 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36', 'sec-fetch-site': 'same-site', 'sec-fetch-mode': 'cors', 'sec-fetch-dest': 'empty', referer: 'http://localhost:5000/', 'accept-encoding': 'gzip', 'accept-language': 'en-GB', cookie: 'vuex-cookie' } }, incomingRes: { headers: { server: 'Werkzeug', date: 'Mon, 08 Aug 2022 10:33:24 GMT', 'content-type': 'application/json', 'content-length': '371', 'cache-control': 'max-age=0, private, no-cache, no-store, must-revalidate, proxy-revalidate, no-transform', pragma: 'no-cache', expires: 'Mon, 08 Aug 2022 10:33:23 GMT', 'access-control-allow-origin': 'http://localhost:5000', 'access-control-allow-credentials': 'true', 'access-control-allow-methods': 'POST, DELETE, PATCH, PUT, GET, OPTIONS', 'access-control-allow-headers': 'Sentry-Trace, Accept, X-Api-Key, X-Amz-Date, X-Amz-Security-Token, X-Amz-User-Agent, X-CSRFToken, X-auth/csrftoken-Translate, Content-Type, Baggage, Authorization', 'access-control-expose-headers': '*', 'access-control-max-age': '600', 'x-content-type-options': 'nosniff', 'strict-transport-security': 'max-age=31536000; includeSubdomains;', 'expect-ct': 'max-age=0', connection: 'close' }, statusCode: 200 } } +17ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingResponse determine injection +1ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingResponse - no injection (not html) +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingResponse injection levels: { isInitial: false, wantsInjection: false, wantsSecurityRemoved: false } +0ms

• 10.3.0

  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e1... IncomingRequest proxying request { req: { method: 'GET', proxiedUrl: 'http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e144a4170611ed81230242ac12000a', headers: { host: 'localhost:5005', 'proxy-connection': 'keep-alive', accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9', 'accept-encoding': 'gzip, deflate, br', 'accept-language': 'en-GB', cookie: 'vuex-cookie; __cypress.initial=true', referer: 'http://localhost:5001/', 'sec-fetch-dest': 'iframe', 'sec-fetch-mode': 'navigate', 'sec-fetch-site': 'same-site', 'upgrade-insecure-requests': '1', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.3.0 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36', 'x-cypress-is-aut-frame': 'true' } } } +17ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e1... IncomingRequest existing cookies on request: vuex-cookie; __cypress.initial=true +2ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e1... IncomingRequest add cookies to request:  +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e1... IncomingRequest waiting for prerequest +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e1... IncomingRequest Incoming request GET-http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e144a4170611ed81230242ac12000a matches known pre-request: { requestId: '8AA60454BFE37E6CAE56608840A8B23F', method: 'GET', url: 'http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e144a4170611ed81230242ac12000a', headers: { Referer: 'http://localhost:5001/', 'Upgrade-Insecure-Requests': '1', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.3.0 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36' }, resourceType: 'other', originalResourceType: 'Document' } +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e1... IncomingResponse received response { req: { method: 'GET', proxiedUrl: 'http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e144a4170611ed81230242ac12000a', headers: { host: 'localhost:5005', 'proxy-connection': 'keep-alive', accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9', 'accept-encoding': 'gzip', 'accept-language': 'en-GB', cookie: 'vuex-cookie; __cypress.initial=true', referer: 'http://localhost:5001/', 'sec-fetch-dest': 'iframe', 'sec-fetch-mode': 'navigate', 'sec-fetch-site': 'same-site', 'upgrade-insecure-requests': '1', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.3.0 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36' } }, incomingRes: { headers: { server: 'Werkzeug', date: 'Mon, 08 Aug 2022 10:39:36 GMT', 'content-type': 'text/html; charset=utf-8', 'content-length': '251', location: 'http://localhost:5000/', 'cache-control': 'max-age=0, private, no-cache, no-store, must-revalidate, proxy-revalidate, no-transform', pragma: 'no-cache', expires: 'Mon, 08 Aug 2022 10:39:35 GMT', 'access-control-allow-origin': 'http://localhost:5000', 'access-control-allow-credentials': 'true', 'access-control-allow-methods': 'POST, DELETE, PATCH, PUT, GET, OPTIONS', 'access-control-allow-headers': 'Sentry-Trace, Accept, X-Api-Key, X-Amz-Date, X-Amz-Security-Token, X-Amz-User-Agent, X-CSRFToken, Content-Type, Baggage, Authorization', 'access-control-expose-headers': '*', 'access-control-max-age': '600', 'x-content-type-options': 'nosniff', 'strict-transport-security': 'max-age=31536000; includeSubdomains;', 'expect-ct': 'max-age=0', vary: 'Cookie', 'set-cookie': [Array], connection: 'close' }, statusCode: 307 } } +166ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e1... IncomingResponse is cross-origin, delay until cross:origin:release:html event +1ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e1... IncomingResponse received cross:origin:release:html, let the response proceed +306ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e1... IncomingResponse determine injection +1ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e1... IncomingResponse - full injection +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e1... IncomingResponse injection levels: { isInitial: true, wantsInjection: 'full', wantsSecurityRemoved: false } +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=bEIu43GAyKsUF3fN&code=65e1... IncomingResponse redirecting to new url { statusCode: 307, newUrl: 'http://localhost:5000/' } +6ms

  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingRequest proxying request { req: { method: 'GET', proxiedUrl: 'http://localhost:5005/auth/csrftoken', headers: { host: 'localhost:5005', 'proxy-connection': 'keep-alive', accept: 'application/json', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.3.0 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36', 'sec-fetch-site': 'same-site', 'sec-fetch-mode': 'cors', 'sec-fetch-dest': 'empty', referer: 'http://localhost:5000/', 'accept-encoding': 'gzip, deflate, br', 'accept-language': 'en-GB', cookie: 'vuex-cookie' } } } +4ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingRequest existing cookies on request: vuex-cookie +2ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingRequest add cookies to request:  +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingRequest waiting for prerequest +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingRequest Incoming request GET-http://localhost:5005/auth/csrftoken matches known pre-request: { requestId: '12960.123', method: 'GET', url: 'http://localhost:5005/auth/csrftoken', headers: { Accept: 'application/json', Referer: 'http://localhost:5000/', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.3.0 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36' }, resourceType: 'xhr', originalResourceType: 'XHR' } +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingResponse received response { req: { method: 'GET', proxiedUrl: 'http://localhost:5005/auth/csrftoken', headers: { host: 'localhost:5005', 'proxy-connection': 'keep-alive', accept: 'application/json', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.3.0 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36', 'sec-fetch-site': 'same-site', 'sec-fetch-mode': 'cors', 'sec-fetch-dest': 'empty', referer: 'http://localhost:5000/', 'accept-encoding': 'gzip', 'accept-language': 'en-GB', cookie: 'vuex-cookie' } }, incomingRes: { headers: { server: 'Werkzeug', date: 'Mon, 08 Aug 2022 10:39:32 GMT', 'content-type': 'application/json', 'content-length': '371', 'cache-control': 'max-age=0, private, no-cache, no-store, must-revalidate, proxy-revalidate, no-transform', pragma: 'no-cache', expires: 'Mon, 08 Aug 2022 10:39:31 GMT', 'access-control-allow-origin': 'http://localhost:5000', 'access-control-allow-credentials': 'true', 'access-control-allow-methods': 'POST, DELETE, PATCH, PUT, GET, OPTIONS', 'access-control-allow-headers': 'Sentry-Trace, Accept, X-Api-Key, X-Amz-Date, X-Amz-Security-Token, X-Amz-User-Agent, X-CSRFToken, Content-Type, Baggage, Authorization', 'access-control-expose-headers': '*', 'access-control-max-age': '600', 'x-content-type-options': 'nosniff', 'strict-transport-security': 'max-age=31536000; includeSubdomains;', 'expect-ct': 'max-age=0', connection: 'close' }, statusCode: 200 } } +17ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingResponse determine injection +1ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingResponse - no injection (not html) +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingResponse injection levels: { isInitial: false, wantsInjection: false, wantsSecurityRemoved: false } +0ms

• 10.3.1

  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=7134... IncomingRequest proxying request { req: { method: 'GET', proxiedUrl: 'http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=71349dcc170811edb1d70242ac12000a', headers: { host: 'localhost:5005', 'proxy-connection': 'keep-alive', accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9', 'accept-encoding': 'gzip, deflate, br', 'accept-language': 'en-GB', cookie: 'vuex-cookie; __cypress.initial=true', referer: 'http://localhost:5001/', 'sec-fetch-dest': 'iframe', 'sec-fetch-mode': 'navigate', 'sec-fetch-site': 'same-site', 'upgrade-insecure-requests': '1', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.3.1 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36', 'x-cypress-is-aut-frame': 'true' } } } +18ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=7134... IncomingRequest existing cookies on request: vuex-cookie; __cypress.initial=true +1ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=7134... IncomingRequest add cookies to request:  +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=7134... IncomingRequest waiting for prerequest +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=7134... IncomingRequest Incoming request GET-http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=71349dcc170811edb1d70242ac12000a matches known pre-request: { requestId: 'C76DA69C9D6E940BCF7BBEC7B92384E9', method: 'GET', url: 'http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=71349dcc170811edb1d70242ac12000a', headers: { Referer: 'http://localhost:5001/', 'Upgrade-Insecure-Requests': '1', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.3.1 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36' }, resourceType: 'other', originalResourceType: 'Document' } +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=7134... IncomingResponse received response { req: { method: 'GET', proxiedUrl: 'http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=71349dcc170811edb1d70242ac12000a', headers: { host: 'localhost:5005', 'proxy-connection': 'keep-alive', accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9', 'accept-encoding': 'gzip', 'accept-language': 'en-GB', cookie: 'vuex-cookie; __cypress.initial=true', referer: 'http://localhost:5001/', 'sec-fetch-dest': 'iframe', 'sec-fetch-mode': 'navigate', 'sec-fetch-site': 'same-site', 'upgrade-insecure-requests': '1', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.3.1 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36' } }, incomingRes: { headers: { server: 'Werkzeug', date: 'Mon, 08 Aug 2022 10:54:14 GMT', 'content-type': 'text/html; charset=utf-8', 'content-length': '251', location: 'http://localhost:5000/', 'cache-control': 'max-age=0, private, no-cache, no-store, must-revalidate, proxy-revalidate, no-transform', pragma: 'no-cache', expires: 'Mon, 08 Aug 2022 10:54:13 GMT', 'access-control-allow-origin': 'http://localhost:5000', 'access-control-allow-credentials': 'true', 'access-control-allow-methods': 'POST, DELETE, PATCH, PUT, GET, OPTIONS', 'access-control-allow-headers': 'Sentry-Trace, Accept, X-Api-Key, X-Amz-Date, X-Amz-Security-Token, X-Amz-User-Agent, X-CSRFToken, Content-Type, Baggage, Authorization', 'access-control-expose-headers': '*', 'access-control-max-age': '600', 'x-content-type-options': 'nosniff', 'strict-transport-security': 'max-age=31536000; includeSubdomains;', 'expect-ct': 'max-age=0', vary: 'Cookie', 'set-cookie': [Array], connection: 'close' }, statusCode: 307 } } +119ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=7134... IncomingResponse is cross-origin, delay until cross:origin:release:html event +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=7134... IncomingResponse received cross:origin:release:html, let the response proceed +311ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=7134... IncomingResponse determine injection +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=7134... IncomingResponse - full injection +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=7134... IncomingResponse injection levels: { isInitial: true, wantsInjection: 'full', wantsSecurityRemoved: false } +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/callback?state=3Bsv8dP2TqftJJRE&code=7134... IncomingResponse redirecting to new url { statusCode: 307, newUrl: 'http://localhost:5000/' } +5ms

  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingRequest proxying request { req: { method: 'GET', proxiedUrl: 'http://localhost:5005/auth/csrftoken', headers: { host: 'localhost:5005', 'proxy-connection': 'keep-alive', accept: 'application/json', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.3.1 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36', 'sec-fetch-site': 'same-site', 'sec-fetch-mode': 'cors', 'sec-fetch-dest': 'empty', referer: 'http://localhost:5000/', 'accept-encoding': 'gzip, deflate, br', 'accept-language': 'en-GB', cookie: 'vuex-cookie' } } } +8ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingRequest existing cookies on request: vuex-cookie +1ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingRequest add cookies to request:  +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingRequest waiting for prerequest +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingRequest Incoming request GET-http://localhost:5005/auth/csrftoken matches known pre-request: { requestId: '27788.255', method: 'GET', url: 'http://localhost:5005/auth/csrftoken', headers: { Accept: 'application/json', Referer: 'http://localhost:5000/', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.3.1 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36' }, resourceType: 'xhr', originalResourceType: 'XHR' } +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingResponse received response { req: { method: 'GET', proxiedUrl: 'http://localhost:5005/auth/csrftoken', headers: { host: 'localhost:5005', 'proxy-connection': 'keep-alive', accept: 'application/json', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/10.3.1 Chrome/100.0.4896.160 Electron/18.3.0 Safari/537.36', 'sec-fetch-site': 'same-site', 'sec-fetch-mode': 'cors', 'sec-fetch-dest': 'empty', referer: 'http://localhost:5000/', 'accept-encoding': 'gzip', 'accept-language': 'en-GB', cookie: 'vuex-cookie' } }, incomingRes: { headers: { server: 'Werkzeug', date: 'Mon, 08 Aug 2022 10:54:15 GMT', 'content-type': 'application/json', 'content-length': '371', 'cache-control': 'max-age=0, private, no-cache, no-store, must-revalidate, proxy-revalidate, no-transform', pragma: 'no-cache', expires: 'Mon, 08 Aug 2022 10:54:14 GMT', 'access-control-allow-origin': 'http://localhost:5000', 'access-control-allow-credentials': 'true', 'access-control-allow-methods': 'POST, DELETE, PATCH, PUT, GET, OPTIONS', 'access-control-allow-headers': 'Sentry-Trace, Accept, X-Api-Key, X-Amz-Date, X-Amz-Security-Token, X-Amz-User-Agent, X-CSRFToken, X-auth/csrftoken-Translate, Content-Type, Baggage, Authorization', 'access-control-expose-headers': '*', 'access-control-max-age': '600', 'x-content-type-options': 'nosniff', 'strict-transport-security': 'max-age=31536000; includeSubdomains;', 'expect-ct': 'max-age=0', connection: 'close' }, statusCode: 200 } } +6ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingResponse determine injection +1ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingResponse - no injection (not html) +0ms
  cypress-verbose:proxy:http GET http://localhost:5005/auth/csrftoken IncomingResponse injection levels: { isInitial: false, wantsInjection: false, wantsSecurityRemoved: false } +0ms

[AtofStryker]

@karlhorky @lehmat thank you both for providing those logs. I think we should have enough information to produce on our end, especially with @karlhorky 's logs containing the failed set cookie due to thinking the request is cross origin, when the cookie really should be set since it is same origin (using the request url and referrer here will be super helpful for us to write a good test)