fix: Fix issue with using privileged commands when baseUrl includes b…

…asic auth credentials

packages/server/lib/privileged-commands/privileged-channel.js

@@ -199,7 +199,11 @@
     // send it to the server, where it's stored in state. when the command is
     // run and it sends its message to the server via websocket, we check
     // that verified status before allowing the command to continue running
-    const promise = fetch(`/${namespace}/add-verified-command`, {
+    //
+    // needs to use the fully-qualified url or else when the baseUrl includes
+    // basic auth, the fetch fails with a security error
+    // see https://github.com/cypress-io/cypress/issues/28336
+    const promise = fetch(`${window.location.origin}/${namespace}/add-verified-command`, {
       body: stringify({
         args,
         name: command.name,

system-tests/projects/privileged-commands/cypress.config.js

@@ -0,0 +1,13 @@
+module.exports = {
+  e2e: {
+    baseUrl: 'http://user:pass@localhost:9999/app',
+    supportFile: false,
+    setupNodeEvents (on) {
+      on('task', {
+        'return:arg' (arg) {
+          return arg
+        },
+      })
+    },
+  },
+}

system-tests/projects/privileged-commands/cypress/e2e/spec.cy.js

@@ -0,0 +1,7 @@
+it('can run privileged commands with basic auth baseUrl', () => {
+  cy.visit('/html')
+  cy.exec('echo "hello"')
+  cy.readFile('cypress/fixtures/example.json')
+  cy.writeFile('cypress/_test-output/written.txt', 'contents')
+  cy.task('return:arg', 'arg')
+})

system-tests/projects/privileged-commands/cypress/fixtures/example.json

@@ -0,0 +1,5 @@
+{
+  "name": "Using fixtures to represent data",
+  "email": "[email protected]",
+  "body": "Fixtures are a great way to mock data for responses to routes"
+}

system-tests/test/base_url_spec.js

@@ -48,6 +48,20 @@ describe('e2e baseUrl', () => {
     })
   })
 
+  // https://github.com/cypress-io/cypress/issues/28336
+  context('basic auth + privileged commands', () => {
+    systemTests.setup({
+      servers: {
+        port: 9999,
+        onServer,
+      },
+    })
+
+    systemTests.it('passes', {
+      project: 'privileged-commands',
+    })
+  })
+
   context('http', () => {
     systemTests.setup({
       servers: {