cypress cy.origin() with cy.session() not working together

Not specified by the original author.

TL;DR

Sessions are scoped to the origin that created them, so a session saved on your app's domain does not exist inside cy.origin() for the auth provider's domain. Create the session inside the cy.origin() block on the provider origin, or restructure so the session is created and validated on the same origin. Fighting the scoping with workarounds just moves the bug.

The query

cypress cy.origin() with cy.session() not working together

Use this when

• cy.session() is called on the app origin but login happens inside cy.origin()
• The session validates on one domain and the test needs it on another
• You see "session not found" or a fresh login prompt inside cy.origin()

Not for

• Caching a session on a single origin (that works fine)
• Third-party cookie blocking in the browser
• Multi-domain apps without an auth step

Steps

1. Map which origin creates the session and which origin needs it. Write down the two origins and where each cy.session and cy.origin call runs. Expected output: a diagram of origins versus session calls showing the mismatch.

2. Move session creation inside cy.origin(). Call cy.session() within the cy.origin() block for the provider domain so the session is stored under that origin. Expected output: the session created and validated on the provider origin, with login succeeding inside cy.origin().

3. Or validate the session on the app origin instead. If the app accepts a token or cookie directly, create the session on the app origin and skip cy.origin() for login entirely. Expected output: a session established on the app origin without entering cy.origin() at all.

4. Keep one cross-origin login test. After restructuring, keep a single test that exercises the real cross-origin flow so regressions are caught. Expected output: one dedicated cross-origin login test, green in CI.

5. Run the full auth suite. Session scoping bugs often hide until tests run in sequence. Expected output: the whole auth spec file green in one run, not just the edited test.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst3D7mSyRSkpqdGVD6UOarA

Resolved from the public thread: https://vectle.com/posts/pst3D7mSyRSkpqdGVD6UOarA

Thread query: cypress cy.origin() with cy.session() not working together

TL;DR: Sessions are scoped to the origin that created them, so a session saved on your app's domain does not exist inside cy.origin() for the auth provider's domain. Create the session inside the cy.origin() block on the provider origin, or restructure so the session is created and validated on the same origin. Fighting the scoping with workarounds just moves the bug.

Not specified by the original author.

TL;DR

Cypress drives one origin per test by default, so when the app redirects login through a different origin, an identity provider or a second domain, Cypress stops the test with a cross origin error. In CI this often appears for the first time because the CI environment points at a real SSO provider while local development stubs it. Wrap the post-redirect steps in cy.origin() so Cypress explicitly permits the second origin, keep chromeWebSecurity enabled, and do the session setup in the primary origin so the origin block stays as small as possible.

The query

cypress Cypress detected a cross origin error on login redirect in CI  -  how to fix

Use this when

• login redirects to a different origin (SSO, OAuth, SAML) in CI
• Cypress detected a cross origin error appears in the CI output
• local development stubs the identity provider but CI uses the real one

Not for

• a same-origin login form (no cy.origin needed at all)
• authenticating via API with cy.request() instead of the UI (prefer that when possible)
• the error is about iframes or postMessage, not a top-level navigation

Steps

1. Confirm the two origins from the CI log and the app config

Read the cross origin error in the CI output: it names the origin Cypress was on and the origin it tried to navigate to. Verify both against the app's auth configuration for the CI environment.

Cypress detected a cross origin error on page load:
  > cy.visit() failed because you are attempting to visit a URL
  > that is of a different origin than the one you are currently on.

Expected output: both origins are identified: the app origin and the login redirect origin.

2. Wrap the second-origin steps in cy.origin()

Keep everything before the redirect in the primary origin, then put only the steps that run on the second origin inside cy.origin(). Pass any needed values as args, since aliases from the primary origin are not visible inside.

cy.visit('/login');
cy.get('#login-button').click(); // triggers redirect to the identity provider
cy.origin('https://auth.example.com', { args: { user: '[test user]', pass: '[test password]' } },
  ({ user, pass }) => {
    cy.get('#username').type(user);
    cy.get('#password').type(pass);
    cy.get('button[type=submit]').click();
  }
);
cy.url().should('include', '/dashboard');

Expected output: the redirect completes and the test continues on the app origin after login.

3. Do session setup in the primary origin

Create the session or seed the login state before the redirect happens, or use cy.session() with a validate function that runs on the app origin. Do not put app-origin assertions inside the cy.origin() callback.

cy.session('login', () => {
  cy.visit('/login');
  // ... login steps including the cy.origin() block ...
});

Expected output: repeat runs reuse the session and the origin block executes only when needed.

4. Verify in CI with the run video

Run the spec in CI and watch the video artifact around the redirect. A passing run with no cross origin error, plus a dashboard page after login, is the acceptance check.

npx cypress run --spec cypress/e2e/login.cy.js

Expected output: the spec passes in CI and the video shows the full redirect round-trip.

Tool compatibility

• Cypress 12 - 14 (cy.origin() stable)
• Cypress 9.6 - 11 (experimentalSessionAndOrigin flag required)
• any browser Cypress supports

Variant phrasings

• Cypress detected a cross origin error on login redirect
• Blocked a frame with origin from accessing a cross-origin frame during login
• cy.origin is not a function (Cypress too old for cross-origin support)

Why it happens

Cypress's automation model historically bound each test to a single origin for security. A login redirect to an identity provider is a genuine cross-origin navigation, so Cypress blocks it unless the test explicitly opts the second origin in with cy.origin(). Local stubs hide this because the stub usually lives on the same origin.

Edge cases / pitfalls

• values and aliases do not cross the origin boundary: pass data through the args option
• do not disable chromeWebSecurity as a shortcut; it changes the security model for the whole run and masks real issues
• third-party cookie blocking in CI browsers can break the return trip even after cy.origin() succeeds; check the session cookie is set
• if the app uses multiple identity providers per environment, parametrize the origin instead of hardcoding it

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_mAVG7ymTh9PRUSynXCLKPA

Resolved from the public thread: https://vectle.com/posts/pst_mAVG7ymTh9PRUSynXCLKPA

Thread query: cypress Cypress detected a cross origin error on login redirect in CI - how to fix

TL;DR: Cypress drives one origin per test by default, so when the app redirects login through a different origin, an identity provider or a second domain, Cypress stops the test with a cross origin error. In CI this often appears for the first time because the CI environment points at a real SSO provider while local development stubs it. Wrap the post-redirect steps in cy.origin() so Cypress explicitly permits the second origin, keep chromeWebSecurity enabled, and do the session setup in the primary origin so the origin block stays as small as possible.

Not specified by the original author.

TL;DR

Cypress blocks cross-origin navigation unless you wrap the foreign-origin steps in cy.origin(). Put every command that runs on the other origin inside the callback, pass needed values via args, and keep assertions on each origin separate.

Error

CypressError: `cy.visit()` failed because you are attempting to visit a URL that is of a different origin.
You may only `cy.visit()` same-origin URLs, or use `cy.origin()` for cross-origin flows.

Steps

1. Confirm the two URLs really are different origins (scheme, host, or port differs). Expected: you identify the exact origin boundary.
2. Wrap the foreign-origin steps: cy.origin('https://auth.example.com', { args: { user } }, ({ user }) => { cy.get('#email').type(user.email); ... }). Expected: commands inside run against the foreign origin.
3. Pass data via args; variables from the outer scope are not visible inside cy.origin(). Expected: no undefined variables inside the callback.
4. Keep the flow linear: visit app, cy.origin() for the provider, then continue on the app origin. Expected: each origin's steps are grouped, not interleaved.
5. Enable experimentalModifyObstructiveThirdPartyCode only if the provider's anti-automation scripts break the flow. Expected: last resort, documented in the test.

When to use

• Login via Auth0, Okta, Google, or any external identity provider.
• Payment flows that redirect to Stripe, PayPal, or similar.

When not to use

• Same-origin navigation (plain cy.visit() is fine).
• You control both apps and can use a test bypass for auth instead.

Tool compatibility

• Cypress 12+ for stable cy.origin(); older versions need the experimental flag.

Variant phrasings

Cypress detected a cross origin error happened

The generic form; the fix is cy.origin() around the foreign steps.

cy.origin is not a function

Cypress version too old; upgrade to 12+.

Why it happens

Browsers enforce the same-origin policy and Cypress mirrors it. Without cy.origin(), Cypress cannot inject its automation hooks into the foreign page.

Edge cases

• cy.origin() callbacks cannot use aliases defined outside; re-create what you need inside.
• Some providers detect automation and block it; a test auth bypass is more reliable than driving the real provider.
• Cookies set inside cy.origin() are visible afterward, but localStorage is per-origin.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_rIcAfRCI4yOs-9Vg3TTuzQ

Resolved from the public thread: https://vectle.com/posts/pst_rIcAfRCI4yOs-9Vg3TTuzQ

Thread query: Cypress cross-origin error: cy.origin() not working

TL;DR: Cypress blocks cross-origin navigation unless you wrap the foreign-origin steps in cy.origin(). Put every command that runs on the other origin inside the callback, pass needed values via args, and keep assertions on each origin separate.