Cypress: Content security policy is not allowing page to be loaded

[jennifer-shehane]

• Cypress Version: 2.1.0

Normally we are able to strip content security policies, but there is something about this url that is causing this to error.

it('example', () => {
 cy.visit('https://login.yahoo.com/config/login?.src=flickrsignin&.pc=8190&.scrumb=0&.pd=c%3DH6T9XcS72e4mRnW3NpTAiU8ZkA--&.intl=in&.lang=en&.done=https%3A%2F%2Flogin.yahoo.com%2Fconfig%2Fvalidate%3F.src%3Dflickrsignin%26.pc%3D8190%26.scrumb%3D0%26.pd%3Dc%253DJvVF95K62e6PzdPu7MBv2V8-%26.intl%3Din%26.done%3Dhttp%253A%252F%252Fwww.flickr.com%252Fsignin%252Fyahoo%252F%253Fredir%253Dhttp%25253A%25252F%25252Fwww.flickr.com%25252F')
})

Error displayed:

Refused to execute inline script because it violates the following Content Security Policy 
directive: "script-src 'self' 'unsafe-eval' ....Either the 'unsafe-inline' keyword, 
a hash ('...'), or a nonce ('nonce-...') is required to enable inline execution.

[benpolinsky]

Same error with https://teams.microsoft.com and Cypress version 3.0.3

I know, I know: only test your own code. Here's my situation:

I'm developing an app for Microsoft Teams. Teams applications are web apps whose URL is embedded by Teams in an iFrame.

Our E2E tests are written in Cypress, and I merely run the app outside of Teams, mocking any needed calls from the Teams library.

However, our company also needs operational tests that ensures the application runs as it will be in production. So we're using Selenium for the ops tests :(

At any rate, perhaps we'll be able to go full Cypress eventually.

Thanks.

[benpolinsky]

@jennifer-shehane Though I haven't delved into Cypress' code base before, I'd be willing to try to take this on if no one else is working on it. Which Cypress package controls this behavior?

[jennifer-shehane]

It should be in the server relating to proxy https://github.com/cypress-io/cypress/blob/develop/packages/server/lib/controllers/proxy.coffee#L1

[jennifer-shehane]

@benpolinsky This error actually looks a bit different and is related to this issue: https://github.com/cypress-io/cypress/issues/3459

[benpolinsky]

@jennifer-shehane Makes sense since Cypress is definitely stripping out the CSP headers, as you mentioned.

[KevinVanthuyne]

Is there a workaround for this in the meantime?