Spike: investigate cookie behavior gaps for `experimentalWebKitSupport`

Summary

Most skipped cookie tests are skipped because cy.origin() doesn't work in WebKit. That is #34869's problem, not this one. After setting those aside, five things remain:

• The WebKit cookie converter hardcodes hostOnly: false.
• clearCookie and clearCookies clear the whole jar and re-add the survivors.
• A cookie with no sameSite attribute reads back differently on macOS and Linux. Nobody knows why.
• Several blocks of cookie tests that never call cy.origin() are skipped anyway, because they sit in files with a file-level guard.
• We don't know whether the Playwright WebKit build has ITP on.

commands/cookies.cy.js runs on WebKit in CI and reports green. But 18 of its tests return early, before the cy.origin() half of the test. The origin/ cookie specs load and report 100% pending. The system-test cookie skips are in the full system-tests-webkit job, so those do reflect current behavior.

Related: #34869, #23799, #29973 (WebKit 26 upgrade that produced the sameSite fork), #26106 (non-persistent context).

What's skipped, minus cy.origin() fallout

hostOnly is hardcoded. packages/server/lib/automation/cookie/converters/webkit.ts:17 sets hostOnly: false on every cookie read from Playwright; the CDP and BiDi converters derive it (converters/cdp.ts:38, converters/bidi.ts:68, via isHostOnlyCookie). This explains the three uncommented assertion skips at commands/cookies.cy.js:27,37,48. Knock-on: automation/cookie/jar.ts:31,60 dedupe on hostOnly, which is exactly the shape of #25174 (duplicate cookies with a prepended dot) — and the two #25174 tests at origin/cookie_misc.cy.ts:7,24 use no cy.origin() yet are skipped. Likely a one-line fix that clears several skips.

Non-cy.origin tests blanket-skipped:

• origin/cookie_behavior.cy.ts:821-1410 — the entire w/o cy.origin half (same-site/cross-site attachment over XHR and fetch, http and https, domain/path/creation-time), killed by the file-level guard at :14.
• origin/cookie_misc.cy.ts:305 — Same-Site Cross-Origin, drives everything through cy.visit/window.top.
• origin/cookie_misc.cy.ts:7,24 — the #25174 tests above.

Cookie state between tests. origin/cookie_misc.cy.ts:3: cookies aren't cleared properly in headless mode with webkit between tests… pass headfully locally. Unverified since 2022. Today: WebKitAutomation.reset rebuilds the Playwright context per spec (webkit-automation.ts:64); between tests, clear:cookies lands on clearCookies (:322), which reads all, clears all, re-adds survivors because Playwright has no filtered clear. Anything context.cookies() doesn't round-trip (creation time, expires: -1, host-only via leading dot) is silently rewritten. reset:browser:state is a no-op (:412) but fires when the context is rebuilt anyway, so probably harmless for cookies.

sameSite by platform. commands/cookies.cy.js:1395-1397 expects no_restriction on macOS and lax on Linux for a cookie set with no attribute, and assumes the divergence is WebKit's. The converter's map has no unspecified entry (automation/cookie/util.ts:11). Determine what WebKit 26.5 stores, whether Playwright reports it faithfully, and whether Cypress should normalize as it does for Firefox at origin/cookie_misc.cy.ts:88. Dead branch: system-tests/projects/e2e/cypress/e2e/multi_cookies.cy.js:68 has a WebKit sameSite expectation that has never executed because its only system test is skipped.

System tests (system-tests/test/cookies_spec.ts, all TODO(webkit): fix+unskip):

• :200 forced-SameSite baseurl run; :254 8 cases (4 domains × 2 schemes) of cookies_spec_baseurl.cy.js; :278 4 cases of cookies_spec_no_baseurl.cy.js.
• :352 multi_cookies.cy.js — genuinely multi-domain, reason fits.
• :408 stale_cookie.cy.js — marked (needs multidomain support) but the spec is entirely localhost same-origin (#25841). Reason doesn't match the test.
• :502 oauth_redirect_cookie.cy.js — multi-domain via server redirect, not cy.origin(), so may be reachable today.
• system-tests/test/page_loading_spec.js:81 — related to document.cookie issue?. The spec tests __cypress.initial, which the proxy implements as a cookie (packages/proxy/lib/http/response-middleware.ts:156), so the guess is well founded; belongs here, not in navigation.

ITP. No reference to ITP / tracking prevention anywhere in the repo or in installed playwright-core; Playwright exposes no toggle. Pinned [email protected] ships WebKit 26.5. Whether that build enables ITP is an open question that can't be answered from the repo — test empirically (third-party cookie, document.cookie cookie, check persistence and partitioning) before treating any failure as a Cypress bug.

Rule out first: cross-origin jar, attach-cross-origin-cookies, copy-cookies-from-response, simulated-top, SameSite policy are all proxy-side and browser-agnostic (jar.ts, packages/proxy/lib/http/util/cookies.ts). WebKit is on the proxy path, so these should hold.

Method

cd packages/driver
yarn cypress:run --browser webkit --spec cypress/e2e/commands/cookies.cy.js
yarn cypress:run:inject-document-domain --browser webkit --spec "cypress/e2e/e2e/origin/cookie_misc.cy.ts,cypress/e2e/e2e/origin/cookie_behavior.cy.ts"
yarn test-system -- --browser webkit system-tests/test/cookies_spec.ts system-tests/test/page_loading_spec.js

On a PoC branch, in order: (1) remove only the non-cy.origin guards — file-level on cookie_behavior.cy.ts and cookie_misc.cy.ts, the three hostOnly skips — and record failures; (2) derive hostOnly in the WebKit converter like cdp.ts does, re-run; (3) remove system-test guards one at a time; (4) run headless and headful side by side for the between-test claim. Leave every guard whose test calls cy.origin() for #34869.

Non-goals

• Fixing anything.
• cy.origin() and every cookie test skipped only because of it — #34869.
• cy.session() storage clearing; the sessions.cy.ts codeFrame guards (stack traces, not cookies).
• Non-cookie storage (#26106), TLS/proxy (#25840), iOS Safari.

Deliverables

• Failure inventory with non-cy.origin guards removed: passes now / fails for a Cypress reason / fails for a WebKit or Playwright reason.
• Ruling on hostOnly with test evidence.
• Ruling on the macOS/Linux sameSite divergence, replacing the assumption at cookies.cy.js:1395.
• Answer on ITP in the pinned build.
• Corrected reasons or removed guards for cookies_spec.ts:408 and page_loading_spec.js:81.
• Follow-ups per gap, sized.

Timebox

TBD after the first run of the blanket-skipped blocks.