Proxy server show incorrectly when execute with npx cypress-ntlm open.

[JoyceNg331]

HI, I'm new to Cypress (started to use it last week). i want to write simple code to auto load for internal website (http://xxxx.com). the access to this website require window authentication.

i had followed the below instruction but still not working.
https://github.com/bjowes/cypress-ntlm-auth/blob/master/README.md

and i noticed when i run "npx cypress-ntlm open", the proxy server also not my company proxy setting

when i run npx cypress open, it can shows my company proxy correctly.

can anyone help ? thanks

[JoyceNg331]

i suspect this is due to the proxy server setup when i run "npx cypress-ntlm open" cause my internal application cannot load.

[bjowes]

Hi @JoyceNg331

I see two possible causes

1. The proxy server requires windows authentication. This is not supported by the plugin
2. The proxy server performs SSL deep inspection, meaning that the actual SSL certificate of the website is replaced by a certificate generated by the proxy. Node will not accept certificates generated by unknown CAs - see the section about troubleshooting TLS in the readme.

If you are able to access your site using http instead of https (even temporarily) you can easily figure out if this is the case. If it works on http, 2 is the issue. If it doesn't work with http either, it is (likely) 1.

As for the proxy address shown by cypress, this is expected. The plugin adds another layer of proxying on top of cypress, which means that any configured corporate proxy is not shown. It is handled by the plugin internally though.

[JoyceNg331]

Hi @bjowes ,

thanks for the replied. yes, my application is required windows authentication. so any idea to solve this problem ?

[mariusfranzen]

Hi @bjowes ,

thanks for the replied. yes, my application is required windows authentication. so any idea to solve this problem ?

Have you made any progress? I'm having the same issue

[bjowes]

@JoyceNg331 and @mariusfranzen

What I meant with possible cause 1 above was not that the application requires windows authentication (this is already expected since otherwise you should not need to use this plugin). However, if there is an corporate proxy between your test client and the application server, which requires windows authentication (some proxies are configured this way), then the plugin won't work.

If you don't know - try running cypress without the plugin and use cy.visit to go to your application. You should see a 401 message since you are not logged in. However, you should be able to determine the source of this message. If it is from your application, the intermediate proxy does not require authentication. If it's not from your application, it is from the proxy - meaning that the plugin won't work for your scenario.

As pointed out by @mariusfranzen, it is also possible that this is a certificate issue as in #112 (and many others actually). If you are able to setup debug logging then this should be clear. For your information, I have been working on a new version of the plugin which has a different approach to certificates. The idea is to make it easier to get up and running, while still keeping the possibility to enable stricter certificate checks later on. I estimate I will need a couple more weeks to complete it.

[mariusfranzen]

If you don't know - try running cypress without the plugin and use cy.visit to go to your application. You should see a 401 message since you are not logged in. However, you should be able to determine the source of this message. If it is from your application, the intermediate proxy does not require authentication. If it's not from your application, it is from the proxy - meaning that the plugin won't work for your scenario.

Thanks for the reply. How exactly can I determine the source of the 401? I'm monitoring my network with the chrome devtools and I can only see cypress related requests. Does this mean that the 401 is from the proxy?

[Akshay08091990]

@JoyceNg331 and @mariusfranzen

What I meant with possible cause 1 above was not that the application requires windows authentication (this is already expected since otherwise you should not need to use this plugin). However, if there is an corporate proxy between your test client and the application server, which requires windows authentication (some proxies are configured this way), then the plugin won't work.

If you don't know - try running cypress without the plugin and use cy.visit to go to your application. You should see a 401 message since you are not logged in. However, you should be able to determine the source of this message. If it is from your application, the intermediate proxy does not require authentication. If it's not from your application, it is from the proxy - meaning that the plugin won't work for your scenario.

As pointed out by @mariusfranzen, it is also possible that this is a certificate issue as in #112 (and many others actually). If you are able to setup debug logging then this should be clear. For your information, I have been working on a new version of the plugin which has a different approach to certificates. The idea is to make it easier to get up and running, while still keeping the possibility to enable stricter certificate checks later on. I estimate I will need a couple more weeks to complete it.

@bjowes - As you mentioned above that, if there is an corporate proxy between your test client and the application server, which requires windows authentication (some proxies are configured this way), then the plugin won't work. ==> is there any solution or workaround for such a scenario where cypress will try to connect the application via the proxy server which requires authentication based on NTLM or Kerberos?

[bjowes]

I have just made a beta version available that will accept (but warn) invalid (such as self signed) certs by default. Please try it out to see if that helps. npm i cypress-ntlm-auth@4.0.0-beta.1

@Akshay08091990 - As for a workaround for scenarios where a corporate proxy requires windows authentication, there is a python library called Px that should work. It would then act as another proxy layer between the plugin and the corporate proxy. I haven't tried this out so I cannot offer support, but Px is able to deal with corporate proxies. https://github.com/genotrance/px

[bjowes]

@mariusfranzen : To identify if the 401 comes from the proxy or from the target server, try to find something that would identify the target server. This could be the "server" header for instance - that would likely be some IIS version if your server is hosted on IIS, while the proxy would return something else (or no server header). You could also look at the actual body of the 401 to see if that gives any hints. Many sites use custom 401 pages - if you get your custom 401 page, it is from the server and not the proxy.

[bjowes]

Found an issue, just released cypress-ntlm-auth@4.0.0-beta.2. Please try that instead.

[mariusfranzen]

I'm affraid that didn't help. We set up a seperate environment specifically for cypress, running with http instead of https, and that fixed our issues. Thanks for the help anyway!

[bjowes]

Closing due to lack of response.