Cookies not being sent in redirect in 3.5.0

[jennifer-shehane]

Current behavior:

I'm not sure what the issue is, but our Single Sign On Recipe is failing here: https://dashboard.cypress.io/#/projects/6p53jw/runs/32571/failures

Desired behavior:

The Single Sign On should log in and reroute to dashboard page.

Steps to reproduce: (app code and test code)

1. Pull down https://github.com/cypress-io/cypress-example-recipes
2. Bump cypress dependency to 3.5.0
3. npm i in root directory
4. cd examples/logging-in__single-sign-on
5. npm start
6. in a new tab npm run cypress:open

Smallest amount of code to run:

it('can authenticate with cy.request', function () {
  cy.getCookie('cypress-session-cookie').should('not.exist')
  cy.request({
    method: 'POST',
    url: 'http://auth.corp.com:7075/login',
    qs: {
      redirectTo: 'http://localhost:7074/set_token',
    },
    form: true,
    body: {
      username: 'jane.lane',
      password: 'password123',
    },
  })
  .then((resp) => {
    expect(resp.status).to.eq(200)
    expect(resp.body).to.include('<h1>Welcome to the Dashboard!</h1>')
  })
})

Versions

3.5.0

[joshpzero]

Confirmed 3.5.0 also broke our SSO on multiple different auth types. Had to revert back to 3.4.1

[bahmutov]

hmm, in this project when I open Cypress 3.5.0 I get still the old version of Electron in the list of browsers, which is really really weird

[bahmutov]

When opening Electron 61 it for real shows in the log

cypress:server:browsers opening browser { displayName: 'Electron', family: 'electron', info: 'Electron is the default browser that comes with Cypress. This is the browser that runs in headless mode. Selecting this browser is useful when debugging. The version number indicates the underlying Chromium version that Electron uses.', isChosen: true, majorVersion: '61', name: 'electron', path: '', version: '61.0.3163.100', isHeaded: true, isHeadless: false }

[bahmutov]

yeahs, seems the process shows Electron at 61 for some reason

[bahmutov]

ok, I had alpha version of 3.5.0 on my machine, now getting the right one

[bahmutov]

Passing test in 3.4.1

Failing test in 3.5.0

Notice 4 requests instead of 3

[bahmutov]

The logs in 3.5.0 (I have added DEBUG=sso to this recipe)

GET /__cypress/tests?p=cypress/integration/logging-in-single-sign-on-spec.js-945 200 537.970 ms - -
  sso in /login +0ms
  sso checking username "jane.lane" and password "password123 +1ms
  sso username and password match, redirecting to "http://localhost:7074/set_token" +0ms
  sso redirecting to 'http://localhost:7074/set_token?id_token=abc123def456' +1ms
POST /login?redirectTo=http%3A%2F%2Flocalhost%3A7074%2Fset_token 302 17.207 ms - 75
  sso /set_token, query token is abc123def456 +5s
  sso redirecting to /dashboard +1ms
GET /set_token?id_token=abc123def456 302 3.774 ms - 32
  sso nope, redirecting to /unauthorized +14ms
GET /dashboard 302 0.537 ms - 35
  sso rendering unauthorized +10ms
GET /unauthorized 200 1.080 ms - 293

Around GET /set_token call

GET /set_token?id_token=abc123def456 302 4.440 ms - 32
  sso ensureLoggedIn middleware, headers [ 'Connection', 'keep-alive', 'user-agent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/3.5.0 Chrome/73.0.3683.121 Electron/5.0.10 Safari/537.36', 'accept', '*/*', 'accept-encoding', 'gzip, deflate', 'referer', 'http://localhost:7074/set_token?id_token=abc123def456', 'host', 'localhost:7074' ] session Session { cookie: { path: '/', _expires: null, originalMaxAge: null, httpOnly: true } } +16ms
  sso nope, redirecting to /unauthorized +3ms

[bahmutov]

The logs for 3.4.1, the same test "can authenticate with cy.request"

GET /__cypress/tests?p=cypress/integration/logging-in-single-sign-on-spec.js-057 200 955.854 ms - -
  sso in /login +0ms
  sso checking username "jane.lane" and password "password123 +2ms
  sso username and password match, redirecting to "http://localhost:7074/set_token" +0ms
  sso redirecting to 'http://localhost:7074/set_token?id_token=abc123def456' +1ms
POST /login?redirectTo=http%3A%2F%2Flocalhost%3A7074%2Fset_token 302 19.954 ms - 75
  sso /set_token, query token is abc123def456 +21s
  sso redirecting to /dashboard +0ms
GET /set_token?id_token=abc123def456 302 3.992 ms - 32
  sso session has id token +13ms
  sso rendering dashboard +0ms
GET /dashboard 200 1.891 ms - 155
  sso session has id token +82ms
  sso rendering dashboard +0ms
GET /dashboard 200 1.346 ms - 155

with more details around GET /set_token call

GET /set_token?id_token=abc123def456 302 4.511 ms - 32
  sso ensureLoggedIn middleware, headers [ 'Connection', 'keep-alive', 'user-agent', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Cypress/3.4.1 Chrome/61.0.3163.100 Electron/2.0.18 Safari/537.36', 'accept', '*/*', 'accept-encoding', 'gzip, deflate', 'referer', 'http://localhost:7074/set_token?id_token=abc123def456', 'host', 'localhost:7074', 'cookie', 'cypress-session-cookie=s%3Aw87luiUkOIcbQPvug2Mx6EcI-xsw_HXg.S7%2F5tUA4EMVHDnDKmUChebs%2FJGQHmIXaapaRBKIrHEs' ] session Session { cookie: { path: '/', _expires: null, originalMaxAge: null, httpOnly: true }, id_token: 'abc123def456' } +13ms
  sso session has id token +2ms
  sso rendering dashboard +0ms

[bahmutov]

@flotwig seems like a cookie is not being sent in 3.5.0 after redirect

[skylock]

In 3.4.1

Cypress sets all cookies from request response headers set-cookie array

In 3.5.0

Cypress sets only first cookie element from request response headers set-cookie array