Cypress incorrectly validates domain of cookies in 3.5.0

Current behavior:

Cookies are failing to set for subdomains during cy.request. E.g. we call /auth of auth.test.server and it returns token cookie with .test.server. In this case cookie is not set.

Desired behavior:

Cookie is set in above example.

Steps to reproduce: (app code and test code)

Look at packages/server/lib/request.coffee#setCookiesOnBrowser:

return if not tough.domainMatch(cookie.domain, parsedUrl.hostname)

And at tough-cookie documentation:

domainMatch(str,domStr[,canonicalize=true])
Answers "does this real domain match the domain in a cookie?". The str is the "current" domain-name and the domStr is the "cookie" domain-name. Matches according to RFC6265 Section 5.1.3, but it helps to think of it as a "suffix match".

So it should be:

return if not tough.domainMatch(parsedUrl.hostname, cookie.domain)

Versions

>=3.5.0

[tozes]

+1, as discussed here, we have exactly the same issue which is stopping us for upgrading from 3.4.1

[fernandopasik]

@tozes your link was broken https://github.com/cypress-io/cypress/issues/5688#issuecomment-558212709