Use SessionId as Cookie to authenticate in browser automation tests

Question

I want to streamline some browser automation scripts and bypass logging into the sandbox via the standard login page (with login and password).

Additionally, our automation scripts authenticate in the sandboxes via SOAP API (Enterprise/Tooling) using login + password + security token combination. This is used to create test data for browser tests via API. And from here, the automation test has a unique SessionId.

I noticed that if I set a browser's cookie sid=<SesssioIdFromSoapAPI> on the domain like https://sandboxDomain.sandbox.my.salesforce.com/ then I can skip the login page, and I log into the org/sandbox automatically.

The issue is that when the automation script needs to do something in the Setup, it gets the message...

We can't display this page because your browser blocks cross-domain cookies, but you can view this page in Salesforce Classic. Click here...

... but if with the same browser with the same security settings, I log in via the login page with username + password, then I get the setup page with no problem...

What should I do with cookies and/or authentication in automation tests to be able to see the Setup Pages?

Answer 1

I'm not 100% sure about why it's throwing that error but only for certain parts of the site. Assuming you're using Chrome or a Chromium based browser, if not already done it's worth disabling web security.

To do that, start the browser with command line argument:

--disable-web-security

If you're using Cypress as your tooling, then you can configure this within the project (I assume other frameworks have a similar option).

import { defineConfig } from 'cypress'

export default defineConfig({
  chromeWebSecurity: false,
})

From the Cypress docs:

Setting chromeWebSecurity to false in Chrome-based browsers allows you to do the following:

• Display insecure content
• Navigate to any superdomain without cross-origin errors with or without cy.origin
• Access cross-origin iframes that are embedded in your application

Cypress docs reference: https://docs.cypress.io/guides/guides/web-security.