fix(jahia-log): isolate the spec marker's request from the visitor's session cookie - #253
Merged
Merged
Conversation
…session cookie executeGroovy authenticates with root's HTTP Basic credentials, but cy.request() still attaches the browser's current cookies. A servlet container commonly binds Basic-Auth to whatever session a request already carries rather than opening an isolated one, so the [BEGIN TEST]/[END TEST] marker beforeEach/afterEach could silently promote the visitor's own session to root before the next command ran. Run the marker's request on a disposable, cleared cookie jar and restore the original snapshot afterward, so it can never touch the session a test (or a suite's loginAndStoreSession) is actually relying on.
Contributor
🦜 Chachalog
|
commit: |
dgriffon
approved these changes
Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
[BEGIN SPEC]/[BEGIN TEST]/[END TEST]/[END SPEC]markersenableSpecsMarker()registers could silently promote the visitor's own session to root, leaking an authenticated view into the very next command the test ran. This fix isolates the marker's request from the browser's session cookie so the feature keeps working exactly as before without that side effect.Why
executeGroovyauthenticates with root's HTTP Basic credentials, but it still runs as acy.request(), which Cypress attaches to the browser's current cookies like any other request to the app's origin. A servlet container commonly binds Basic-Auth to whatever session a request already carries rather than opening an isolated one, so if the visitor's own session cookie rode along, that session's identity got mutated server-side to root — invisible to the marker itself, but not to whatever the test did next on that same cookie jar.This is what Jahia/jahia-cypress#251 reports: a consumer moving from 8.2.1 to 8.4.0 saw a logged-in footer on the first page visit after a
beforehook that ends incy.logout(). I bisected the regression to this exact mechanism — not to the user-helpers rework the issue's own investigation suspected (that PR predates the 8.2.1 tag and isn't part of the 8.2.1→8.4.0 delta at all). The marker (#234) is the commit that introduced the observable failure, confirmed by building both sides of it from source and running the reporter's own repro spec against each.Two assumptions are verified:
clearCookies()after the marker's request does fix it, but would silently log out any suite that establishes a session once in an outerbeforeand expects it to persist across every test in the spec (a common pattern, and exactly whatloginAndStoreSession'scy.session()caching exists for).Changes
src/support/jahiaLog.ts—enableSpecsMarker()'s four hook bodies now run theirexecuteGroovycall through a newwithPreservedCookies()helper: snapshot the current cookies, clear the jar, run the marker request (so it gets a disposable session of its own, with nothing pre-existing for Basic-Auth to mutate), clear again, then restore the original snapshot exactly. A session a suite legitimately established earlier is untouched; the marker's own request can never leak into whatever runs right after it.Validation
yarn buildandyarn lint— clean.ghcr.io/jahia/jahia-ee-dev:8-SNAPSHOTwithluxe-jahia-demoinstalled, running itstests/cypress/e2e/forms/61-login.cy.tsspec — the exact repro from the issue and from Jahia/luxe-jahia-demo#461:@jahia/cypress@8.2.1/8.3.0/8.4.0(as published): 8.2.1 passes 7/7, 8.3.0 and 8.4.0 both fail identically onshows the back-office login entry to anonymous visitors.Documentation
None — the marker's own behavior and log output are unchanged; only its side effect on the browser's session is removed.
ADR
None.