cypress-io · chrisbreiding · Mar 22, 2022 · Feb 28, 2022 · Feb 28, 2022 · Feb 28, 2022
diff --git a/packages/driver/cypress/fixtures/auth/cookie-login.html b/packages/driver/cypress/fixtures/auth/cookie-login.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+  <select data-cy="sameSite">
+    <option value="">Empty</option>
+    <option value="None">None</option>
+    <option value="Lax">Lax</option>
+    <option value="Strict">Strict</option>
+    <option value="Invalid">Invalid</option>
+  </select>
+  <label>
+    <input type="checkbox" data-cy="secure" /> Secure
+  </label>
+  <label for="name">Username: </label>
+  <input data-cy="username" type="text" required>
+  <button data-cy="login">Login</button>
+
+  <script>
+    document.querySelector('[data-cy="login"]').addEventListener('click', () => {
+      const queryString = window.location.search;
+      const urlParams = new URLSearchParams(queryString);
+      const redirect = urlParams.get('redirect')
+      const username = document.querySelector('[data-cy=username]').value
+      const sameSite = document.querySelector('[data-cy=sameSite]').value
+      const secure = document.querySelector('[data-cy=secure]').checked
+      let url = `https://www.foobar.com:3502/cookie-login?redirect=${redirect}&username=${username}`
+
+      if (sameSite) {
+        url += `&sameSite=${sameSite}`
+      }
+
+      if (secure) {
+        url += `&secure=true`
+      }
+
+      window.location.href = url
+    })
+  </script>
+</body>
+</html>
diff --git a/packages/driver/cypress/fixtures/multi-domain.html b/packages/driver/cypress/fixtures/multi-domain.html
@@ -19,6 +19,8 @@
     <a data-cy="files-form-link" href="http://www.foobar.com:3500/fixtures/files-form.html">http://www.foobar.com:3500/fixtures/files-form.html</a>
     <a data-cy="errors-link" href="http://www.foobar.com:3500/fixtures/errors.html">http://www.foobar.com:3500/fixtures/errors.html</a>
     <a data-cy="screenshots-link" href="http://www.foobar.com:3500/fixtures/screenshots.html">http://www.foobar.com:3500/fixtures/screenshots.html</a>
+    <a data-cy="cookie-login" href="http://www.foobar.com:3500/fixtures/auth/cookie-login.html?redirect=http://localhost:3500/login">Login with Social</a>
+    <a data-cy="welcome" href="http://localhost:3500/welcome">Go to Welcome</a>
   </div>
 </body>
 </html>
diff --git a/packages/driver/cypress/integration/e2e/multi-domain/cookie_login_spec.ts b/packages/driver/cypress/integration/e2e/multi-domain/cookie_login_spec.ts
@@ -0,0 +1,96 @@
+// @ts-ignore / session support is needed for visiting about:blank between tests
+describe('multi-domain - cookie login', { experimentalSessionSupport: true }, () => {
+  const verifyLoggedIn = (username) => {
+    cy.get('h1')
+    .invoke('text')
+    .should('equal', `Welcome, ${username}!`)
+  }
+
+  it('works in a session', () => {
+    cy.session('ZJohnson', () => {
+      cy.visit('/fixtures/multi-domain.html')
+      cy.get('[data-cy="cookie-login"]').click()
+      cy.switchToDomain('http://foobar.com:3500', () => {
+        cy.get('[data-cy="username"]').type('ZJohnson')
+        cy.get('[data-cy="login"]').click()
+      })
+    }, {
+      validate () {
+        cy.getCookie('user').its('value').should('equal', 'ZJohnson')
+      },
+    })
+
+    cy.visit('/welcome')
+    verifyLoggedIn('ZJohnson')
+  })
+
+  describe('SameSite handling', () => {
+    beforeEach(() => {
+      cy.visit('/fixtures/multi-domain.html')
+      cy.get('[data-cy="cookie-login"]').click()
+    })
+
+    it('works with no SameSite, no Secure', () => {
+      cy.switchToDomain('http://foobar.com:3500', () => {
+        cy.get('[data-cy="username"]').type('AJohnson')
+        cy.get('[data-cy="login"]').click()
+      })
+
+      verifyLoggedIn('AJohnson')
+    })
+
+    it('works with SameSite=None, Secure', () => {
+      cy.switchToDomain('http://foobar.com:3500', () => {
+        cy.get('[data-cy="sameSite"]').select('None')
+        cy.get('[data-cy="secure"]').check()
+        cy.get('[data-cy="username"]').type('BJohnson')
+        cy.get('[data-cy="login"]').click()
+      })
+
+      verifyLoggedIn('BJohnson')
+    })
+
+    it('works with SameSite=None, no Secure', () => {
+      cy.switchToDomain('http://foobar.com:3500', () => {
+        cy.get('[data-cy="sameSite"]').select('None')
+        cy.get('[data-cy="username"]').type('CJohnson')
+        cy.get('[data-cy="login"]').click()
+      })
+
+      verifyLoggedIn('CJohnson')
+    })
+
+    it('works with SameSite=Lax, Secure', () => {
+      cy.switchToDomain('http://foobar.com:3500', () => {
+        cy.get('[data-cy="sameSite"]').select('Lax')
+        cy.get('[data-cy="secure"]').check()
+        cy.get('[data-cy="username"]').type('DJohnson')
+        cy.get('[data-cy="login"]').click()
+      })
+
+      verifyLoggedIn('DJohnson')
+    })
+
+    it('works with SameSite=Strict, Secure', () => {
+      cy.switchToDomain('http://foobar.com:3500', () => {
+        cy.get('[data-cy="sameSite"]').select('Strict')
+        cy.get('[data-cy="secure"]').check()
+        cy.get('[data-cy="username"]').type('EJohnson')
+        cy.get('[data-cy="login"]').click()
+      })
+
+      verifyLoggedIn('EJohnson')
+    })
+
+    it('works with invalid SameSite, Secure', () => {
+      cy.switchToDomain('http://foobar.com:3500', () => {
+        cy.get('[data-cy="sameSite"]').select('Invalid')
+        cy.get('[data-cy="secure"]').check()
+        cy.get('[data-cy="username"]').type('FJohnson')
+        cy.get('[data-cy="login"]').click()
+      })
+
+      verifyLoggedIn('FJohnson')
+    })
+  })
+})
diff --git a/packages/driver/cypress/plugins/server.js b/packages/driver/cypress/plugins/server.js
@@ -10,7 +10,6 @@ const multer = require('multer')
 const upload = multer({ dest: 'cypress/_test-output/' })
 
 const PATH_TO_SERVER_PKG = path.dirname(require.resolve('@packages/server'))
-const { getPathToDist } = require('@packages/resolve-dist')
 
 const httpPorts = [3500, 3501]
 const httpsPort = 3502
@@ -27,6 +26,7 @@ const createApp = (port) => {
   })
 
   app.use(require('cors')())
+  app.use(require('cookie-parser')())
   app.use(require('compression')())
   app.use(bodyParser.urlencoded({ extended: false }))
   app.use(bodyParser.json())
@@ -190,9 +190,67 @@ const createApp = (port) => {
     .send('<html><body>server error</body></html>')
   })
 
-  app.get('/cypress_multi_domain_runner.js', (req, res) => {
-    res.type('application/javascript')
-    res.sendFile(getPathToDist('runner', 'cypress_multi_domain_runner.js'))
+  const getCookieAdditions = ({ sameSite, secure }) => {
+    let additions = ''
+
+    if (sameSite) additions += `; SameSite=${sameSite}`
+
+    if (secure) additions += '; Secure'
+
+    return additions
+  }
+
+  app.get('/cookie-login', (req, res) => {
+    const { username, redirect } = req.query
+
+    res
+    .header('Set-Cookie', `user=${username}${getCookieAdditions(req.query)}`)
+    .redirect(302, `/verify-cookie-login?username=${username}&redirect=${redirect}`)
+  })
+
+  app.get('/verify-cookie-login', (req, res) => {
+    if (!req.cookies.user) {
+      return res
+      .status(403)
+      .send('<html><body><h1>Not logged in</h1></body></html>')
+    }
+
+    const { username, redirect } = req.query
+
+    res.send(`
+      <html>
+        <body>
+          <h1>Redirecting ${username}...</h1>
+          <script>
+            setTimeout(() => {
+              window.location.href = '${redirect}?username=${username}'
+            }, 1000)
+          </script>
+        </body>
+      </html>
+    `)
+  })
+
+  app.get('/login', (req, res) => {
+    const { username } = req.query
+
+    if (!username) {
+      return res.send('<html><body><h1>Must specify username to log in</h1></body></html>')
+    }
+
+    // can't use res.cookie() because it won't allow setting an invalid
+    // SameSite value, which we want to test
+    res
+    .header('Set-Cookie', `user=${username}${getCookieAdditions(req.query)}`)
+    .redirect(302, '/welcome')
+  })
+
+  app.get('/welcome', (req, res) => {
+    if (!req.cookies.user) {
+      return res.send('<html><body><h1>No user found</h1></body></html>')
+    }
+
+    res.send(`<html><body><h1>Welcome, ${req.cookies.user}!</h1></body></html>`)
   })
 
   let _var = ''

diff --git a/packages/driver/package.json b/packages/driver/package.json
@@ -45,6 +45,7 @@
     "chokidar-cli": "2.1.0",
     "clone": "2.1.2",
     "compression": "1.7.4",
+    "cookie-parser": "1.4.5",
     "core-js-pure": "3.21.0",
     "cors": "2.8.5",
     "cypress-multi-reporters": "1.4.0",

diff --git a/packages/driver/src/cypress/cy.ts b/packages/driver/src/cypress/cy.ts
@@ -936,9 +936,6 @@ export class $Cy extends EventEmitter2 implements ITimeouts, IStability, IAssert
             // TODO: handle no longer error when ended early
             cy.doneEarly()
 
-            // if using multi-domain, unbind any listeners waiting for a done() callback to come from cross domain
-            // @ts-ignore
-            Cypress.multiDomainCommunicator.emit('unbind:done:called')
             originalDone(err)
 
             // return null else we there are situations

diff --git a/packages/network/lib/cors.ts b/packages/network/lib/cors.ts
@@ -84,6 +84,15 @@ export function urlMatchesOriginPolicyProps (urlStr, props) {
   return _.isEqual(parsedUrl, props)
 }
 
+export function urlOriginsMatch (url1, url2) {
+  if (!url1 || !url2) return false
+
+  const parsedUrl1 = parseUrlIntoDomainTldPort(url1)
+  const parsedUrl2 = parseUrlIntoDomainTldPort(url2)
+
+  return _.isEqual(parsedUrl1, parsedUrl2)
+}
+
 export function urlMatchesOriginProtectionSpace (urlStr, origin) {
   const normalizedUrl = uri.addDefaultPort(urlStr).format()
   const normalizedOrigin = uri.addDefaultPort(origin).format()

diff --git a/packages/network/lib/uri.ts b/packages/network/lib/uri.ts
@@ -6,7 +6,7 @@
 // - https://nodejs.org/api/url.html#url_url_format_urlobject
 
 import _ from 'lodash'
-import url from 'url'
+import url, { URL } from 'url'
 
 // yup, protocol contains a: ':' colon
 // at the end of it (-______________-)
@@ -87,3 +87,19 @@ export function addDefaultPort (urlToCheck) {
 export function getPath (urlToCheck) {
   return url.parse(urlToCheck).path
 }
+
+const localhostIPRegex = /^127(?:\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}$/
+
+export function isLocalhost (url: URL) {
+  return (
+    // https://datatracker.ietf.org/doc/html/draft-west-let-localhost-be-localhost#section-2
+    url.hostname === 'localhost'
+    || url.hostname.endsWith('.localhost')
+    // [::1] is the IPv6 localhost address
+    // See https://datatracker.ietf.org/doc/html/rfc4291#section-2.5.3
+    || url.hostname === '[::1]'
+    // 127.0.0.0/8 are considered localhost for IPv4
+    // See https://datatracker.ietf.org/doc/html/rfc5735 (Page 3)
+    || localhostIPRegex.test(url.hostname)
+  )
+}
diff --git a/packages/network/test/unit/uri_spec.ts b/packages/network/test/unit/uri_spec.ts
@@ -0,0 +1,40 @@
+import { expect } from 'chai'
+import { URL } from 'url'
+
+import { uri } from '../../lib'
+
+describe('lib/uri', () => {
+  context('.isLocalhost', () => {
+    it('http://localhost is localhost', () => {
+      expect(uri.isLocalhost(new URL('http://localhost'))).to.be.true
+    })
+
+    it('https://localhost is localhost', () => {
+      expect(uri.isLocalhost(new URL('https://localhost'))).to.be.true
+    })
+
+    it('http://127.0.0.1 is localhost', () => {
+      expect(uri.isLocalhost(new URL('http://127.0.0.1'))).to.be.true
+    })
+
+    it('http://127.0.0.9 is localhost', () => {
+      expect(uri.isLocalhost(new URL('http://127.0.0.9'))).to.be.true
+    })
+
+    it('http://[::1] is localhost', () => {
+      expect(uri.isLocalhost(new URL('http://[::1]'))).to.be.true
+    })
+
+    it('http://128.0.0.1 is NOT localhost', () => {
+      expect(uri.isLocalhost(new URL('http://128.0.0.1'))).to.be.false
+    })
+
+    it('http:foobar.com is NOT localhost', () => {
+      expect(uri.isLocalhost(new URL('http:foobar.com'))).to.be.false
+    })
+
+    it('https:foobar.com is NOT localhost', () => {
+      expect(uri.isLocalhost(new URL('https:foobar.com'))).to.be.false
+    })
+  })
+})