Cypress getting odd duplicate cookies set - http

Question

I'm setting up a Cypress E2E test, with a basic first step of loading the app and signing in. When cypress loads the page, however, I see odd behavior in that the cookies are being set twice, kindof, like:
xsrftoken - someValue123 - env.app.domain.com // hostOnly: true
xsrftoken - otherValue12 - .env.app.domain.com // hostOnly: false
sessiontoken - someValue - env.app.domain.com // hostOnly: true
sessiontoken - someValue - .env.app.domain.com // hostOnly: false
sessiontoken value stays consistent if I use cy.session (see code below), otherwise it also differs between the two. The only difference besides the leading . is the hostOnly value.
This appears to cause problems because (from what I can tell) on subsequent requests the wrong xsrftoken gets sent.
When I visit the app outside of Cypress, the cookies are only set once:
xsrftoken - someValue123 - env.app.domain.com
sessiontoken - someValue - env.app.domain.com
The Cypress setup is pretty basic:
// With this setup, the sessiontoken doesn't change, but the xsrftoken does,
// and the "Signs in" test doesn't get an authenticated session.
beforeEach(() => {
cy.session('mySession', () => {
cy.visit('https://env.app.domain.com/')
cy.get('input[type="text"]').type('userName');
cy.get('input[type="password"]').type('passWord');
cy.get('button[type="submit"').click();
})
})
it('Signs in', () => {
cy.visit('https://env.app.domain.com/')
})
// With just this single setup I can sign in successfully if I clear initial cookies:
it('Signs in', () => {
cy.visit('https://env.app.domain.com/')
cy.get('input[type="text"]').type('userName');
cy.get('input[type="password"]').type('passWord');
cy.clearAllCookies(); // <-- Should not need this...
cy.get('button[type="submit"').click();
})
I don't really think this is a Cypress issue, but maybe I'm wrong? I believe the server is some kind of nginx - I'm not certain of the exact configuration BUT I don't see this same behavior in other environments for the same app I do see this in other environments, although initially I thought I did not, at least for a few test runs.
I'm looking for either a workaround (prevent certain cookies being set?) or a root cause.

Answer 1

I think it might be a Cypress issue since I also have it with csrf cookies: it creates 2: one regular, second with . in
As I cannot clear all cookies in my circumstances, I have to clear them individually
cy.clearCookie('_csrf', {domain: 'domain'});
cy.clearCookie('_csrf', {domain: '.domain'});
Update: there is an existing issue on github: https://github.com/cypress-io/cypress/issues/25174