chromeWebSecurity workaround for Cross origin errors no longer working.

Current behavior:

Using { "chromeWebSecurity": false } is not being respected when the test is running since the upgrade from Chrome 66 -> 67.

CypressError: Cypress detected a cross origin error happened on page load:

  Blocked a frame with origin "url" from accessing a cross-origin frame.

Before the page load, you were bound to the origin policy:
  url2

Desired behavior:

Previously the bypass would allow the test to run and pass over the error

Steps to reproduce:

https://github.com/jjp390/cypress-test-tiny From here, run npx cypress open and then run the test spec.js and it will throw the error at the end despite the added file in cypress.json

Versions

Cypress 3.0.1, OSX 10.13.5, Chrome 67

[brian-mann]

I looked into this and it’s because in Chrome 67 they’ve begun to randomly roll out Site Isolation.

It’s currently a Known Isssue documented here that this breaks the --disable-web-security flag. http://www.chromium.org/Home/chromium-security/site-isolation

I believe that because it is a random rollout then only a subset of users are experiencing this. Did you know that Chrome does A/B experiments and collects the usage?

It’s likely that either Chrome 69 (currently Canary) has either fixed this or, or on that browser you do not have Site Isolation enabled.

TO FIX THIS:

Add the --disable-site-isolation-trials argument to chrome via https://docs.cypress.io/api/plugins/browser-launch-api.html#Usage

We’ll go ahead and update the flags to include this by default.

IN THE FUTURE:

Chrome upgrades should never really affect you this much. For instance, nobody is ever forcing you to upgrade. Whenever newer versions come out that break things in Cypress you should:

• Try Canary to see if its fixed
• Use the built in Cypress Electron browser
• Download the previous version of Chrome you were using by downloading Chromium

You can download Chromium here: https://chromium.woolyss.com/download/

This site also has links to download previous version of Chromium:

• https://chromium.woolyss.com/#mac-64-bit
• https://github.com/macchrome/macstable/releases/tag/v67.0.3396.87-r550428-macOS

[jsjoeio]

For those who come here after me, the only thing I had to do was modify the cypress.json file and add:

{
  "chromeWebSecurity": false
}

Reference: Disabling Web Security from the Cypress Docs