This commit is contained in:
2026-02-15 17:02:45 -08:00
parent de9d1b6c27
commit be9bd465af

View File

@@ -1,74 +1,4 @@
Password breach warning error mitigation:
To suppress Chrome's "password exposed in breach" warning during Cypress tests with intentional weak test passwords, **disable Chrome's password leak detection features via browser launch flags**. This is the cleanest, most reliable solution for test environments.
### ✅ Recommended Fix (Cypress Config)
Add this to your Cypress configuration to disable the relevant Chrome features:
#### For Cypress v10+ (`cypress.config.js`):
```javascript
const { defineConfig } = require('cypress');
module.exports = defineConfig({
e2e: {
setupNodeEvents(on, config) {
on('before:browser:launch', (browser, launchOptions) => {
if (browser.name === 'chrome') {
// Disable password breach warnings + related features
launchOptions.args.push(
'--disable-features=PasswordLeakDetection,PasswordManagerLeakDetection,PasswordCheck,InsecureCredentialsWarning'
);
// Optional: Disable password manager entirely if warnings persist
// launchOptions.args.push('--disable-blink-features=PasswordManager');
}
return launchOptions;
});
},
},
});
```
#### For Cypress ≤ v9 (`cypress/plugins/index.js`):
```javascript
module.exports = (on, config) => {
on('before:browser:launch', (browser, launchOptions) => {
if (browser.name === 'chrome') {
launchOptions.args.push(
'--disable-features=PasswordLeakDetection,PasswordManagerLeakDetection,PasswordCheck,InsecureCredentialsWarning'
);
}
return launchOptions;
});
};
```
### 🔑 Why this works:
- `PasswordLeakDetection` / `PasswordManagerLeakDetection`: Blocks breach-checking logic
- `PasswordCheck`: Disables Chrome's "Password Checkup" feature
- `InsecureCredentialsWarning`: Suppresses "insecure password" UI warnings (critical for obvious passwords like "Accounting")
- Flags are **non-intrusive**—they dont alter your apps behavior or test logic
- Works in both headed and headless Chrome modes
- Zero maintenance vs. fragile DOM-interaction workarounds
### ⚠️ Important Notes:
1. **Test passwords remain intentionally weak**—this solution *only* silences Chrome's UI warning.
🔒 *Never use these passwords outside isolated test environments.*
2. If warnings persist:
- Update Chrome flags based on your Chrome version (check `chrome://version` → "Command Line")
- Temporarily add `--disable-blink-features=PasswordManager` (disables entire password manager; use only if tests dont rely on autofill)
3. **Do NOT**:
- Try clicking away the warning in tests (flaky, slows tests, fragile selector)
- Disable Safe Browsing globally (`--safebrowsing-disable-auto-update`)—overly broad security risk
- Modify system Chrome settings (Cypress uses isolated profiles)
### 💡 Pro Tip:
For future-proofing, consider generating **unique strong passwords per test run** (e.g., `Accounting_${Date.now()}`) and resetting them between tests. This avoids breach warnings *and* aligns with security best practices—but the flag solution above is perfect for your current constraint of fixed sample passwords. 😊
=-=-=-=-=-=-=-=-=-=-=-=- =-=-=-=-=-=-=-=-=-=-=-=-
From the olden times years ago: From the olden times years ago:
@@ -86,9 +16,6 @@ todo: meter reading table click on item to confirm item page no other way to eas
TODO: high priority grid sort and filter test that excercises *all* options and filter types TODO: high priority grid sort and filter test that excercises *all* options and filter types
this one will be hugely important as part of regression test as it was a constant source of issues in v7 this one will be hugely important as part of regression test as it was a constant source of issues in v7
todo: drawing signature test might work with this code:
cy.get('.main-canvas').trigger('mousedown', 500, 100, { force: true }).trigger('mousemove', 500, 200, { force: true }).trigger('mouseup', { force: true });
Service user features work Service user features work
sb self contained and use standard test data because will also want to run without accounting prior sb self contained and use standard test data because will also want to run without accounting prior