cy.setCookie is broken with chrome 77

[bryant-slack]

Current behavior:

Desired behavior:

Steps to reproduce: (app code and test code)

run the following test: it will fail:

/// <reference types="Cypress" />

context('Window', () => {
  beforeEach(() => {
    cy.visit('http://google.com')
  })

  it('cy.window() - can set cookies', () => {
    // https://on.cypress.io/window
    cy.setCookie('cookieKey', 'angelfoobar', {
  		domain: '.google.com',
  		path: '/',
  		httpOnly: true,
  		secure: true,
  	});
  })

})

If you remove the domain it works:

/// <reference types="Cypress" />

context('Window', () => {
  beforeEach(() => {
    cy.visit('http://google.com')
  })

  it('cy.window() - can set cookies', () => {
    // https://on.cypress.io/window
    cy.setCookie('cookieKey', 'angelfoobar', {
  		path: '/',
  		httpOnly: true,
  		secure: true,
  	});
  })

})

NOTE: this works fine on chrome 76. it broke with chrome 77 upgrade.

Versions

Max OS 10.14.6
Chrome 77
Cypress 3.4.1

[flotwig]

Hey @bryant-slack, the error you're experiencing comes from Chrome's Cookies API, which means something is wrong with the supplied cookie's format.

Have you tried changing domain: '.google.com' to domain: 'google.com'? The leading dot may be invalid in this setting.

[jennifer-shehane]

@flotwig Leading . should be ignored per the spec though https://tools.ietf.org/html/rfc6265#section-4.1.2.3 So I doubt that it's the domain format.

Previous convo: #1896 (comment)

[flotwig]

Yeah, but I think the Chrome extensions API specifically does not follow that convention (check the docs link above for how Chrome extensions structure cookies vs. how the RFC is written), instead setting a HostOnly cookie only if the domain option is missing entirely. It's worth a try I think.

[bryant-slack]

Just going on a website and looking at the cookies it seems that they are able to set the cookies with the . in front on chrome 77

Example on github:

I can try it without the . and if that works it should unblock me, but this could still be a bug?

[flotwig]

The DevTools display the cookies in the Chrome DevTools Protocol format, which does use a leading . to denote non-HostOnly cookies: https://chromedevtools.github.io/devtools-protocol/tot/Network/#type-Cookie

Chrome extensions API (which Cypress uses) uses a HostOnly boolean to denote that instead: https://developer.chrome.com/extensions/cookies#type-Cookie

Try without the .. If that works, this is still probably something we should clean up for the user so that the behavior is more expected.

[bryant-slack]

this looks like it works for us if we remove the .

[flotwig]

Nice! It does work fine with the . on Chrome 76, just not Chrome 77?

[bryant-slack]

Yes that is correct, before we had the . there and after chrome 77 upgrade we started noticing this part starting failing as the above example shows. If you run the above example on 76 it works fine.

[cypress-bot]

The code for this is done in cypress-io/cypress#5297, but has yet to be released.
We'll update this issue and reference the changelog when it's released.

[cypress-bot]

The code for this is done in cypress-io/cypress#5297, but has yet to be released.
We'll update this issue and reference the changelog when it's released.

[cypress-bot]

Released in 3.5.0.