CORS error, Origin lost in new Lighthouse browser tab

[RJKeane2000]

Current behavior

I’m following this pattern to login as part of my Cypress test. In addition, I include @cypress-audit/lighthouse and call cy.lighthouse.

As I updated versions of Cypress starting at 12.17.2, I noticed the performance numbers generated from Lighthouse were reduced and that I had to adjust the defaultCommandTimeout to get around timeouts occurring when trying to authenticate with Entra ID (Azure AD). I lowered the timeout by 1 second until timeouts started happening to determine the value for my test.

When cy.lighthouse is called, a new tab is opened, the page is rendered after going through the login steps again while Google lighthouse is monitoring the page performance. With the version 13.5.0, the call to Microsoft to authenticate is erroring out with a CORS error. I compared the http request with an earlier version of Cypress and noticed that the "origin" header is missing when using 13.5.0. I read the release notes for 13.5.0. Do you think the fix for #28113 is removing the origin header in the new tab opened when calling cy.lighthouse?

Cypress 12.17.2 – Timeout: 6000, Performance: 76
Cypress 12.17.13 – Timeout: 6000, Performance: 61
Cypress 13.2.0 – Timeout: 6000, Performance: 61
Cypress 13.3.0 – Timeout: 6000, Performance: 61
Cypress 13.3.1 – Timeout: 9000, Performance: 55
Cypress 13.4.0 – Timeout: 8000, Performance: 55
Cypress 13.5.0 – Timeout: 8000, Performance: CORS error when calling Microsoft for authentication. Missing Origin header. This header was present when making the same call with earlier versions of Cypress

Desired behavior

I should be able to authenticate with Entra ID in new tab opened by call to cy.lighthouse from my Cypress testcase.

Test code to reproduce

package.json includes:
@cypress-audit/lighthouse: "1.4.2"
cypress: "13.5.0"
@azure/msal-react: "2.0.7"

Navigate to a page protected by Entra ID. Authenticated to application using this pattern.
At the end of the testcase, call cy.lighthouse(). CORS error occurs when calling Microsoft but only in the new tab opened by Lighthouse. CORS error does not happen in Cypress tab where testcase runs.

Cypress Version

13.5.0

Node version

v19.7.0

Operating System

Windows 10

Debug Logs

No response

Other

No response

[chrisbreiding]

There's a regression in 13.5.0 where pages loaded in new tabs are missing any response headers. This will be fixed by #28322 and should be out in the next release.

[cypress-bot]

Released in 13.5.1.

This comment thread has been locked. If you are still experiencing this issue after upgrading to
Cypress v13.5.1, please open a new issue.