Hello, fellow Cypress users,
February has been a month of ❤️ for all end-to-end testing lovers, lots of interesting news and updates. Let’s jump right in.
What happens if you are testing a website, and the website code has the following code:
Let’s try it.
Hmm, it simply prints everything that you pass to Cypress via environment variables, which could be user names, passwords, authentication tokens, anything really. This is a security hole, and it finally got patched. Now you need to be explicit about secrets vs “normal” values. If a variable is secret, you must use the new cy.env command. If a variable is “normal” and non-privileged, you can still use a global “storage” via Cypress.expose methods. For example, in our cypress.config.js file we now have 2 blocks instead of “env”; the “greeting” value is not a secret, while the “username” and “password” values should be kept secret from the website itself:
Let’s look at the typical before and after code (this example comes from a bonus lesson in my “Testing The Swag Store” online course):
Notice how the Cypress.env and Cypress.expose can be used outside any tests - because the values are available during spec bundling. Meanwhile, cy.env can only be called inside a hook or the test callback (just like normal “cy” commands). You can read more on how to migrate in the official Cypress migration document.
Moving away from Cypress.env requires updating both specs AND plugins, I have to update my plugins like cypress-data-session and @bahmutov/cypress-code-coverage. Luckily, there is a new NPM publishing process using trusted publishing from GitHub Actions that I just described in a new blog post:
Warning: while Cypress no longer bundles secrets (unless you explicitly expose them), the website can still call Cypress.config() method to see your entire config object.
The config might have values that might be sensitive.
By the way, inspect the global Cypress object exposed to the application - it has a lot of interesting stuff! Let’s try “hacking” the cy.env command via cy.now command; can we see the protected values now?
We are safe for now. Ok, let’s move on.
Cypress-the-company has finally published an official “Migrating from Playwright to Cypress“ guide. Hmm, three things:
5 years too late
The guide shows how to change code, does not say WHY one would migrate
The examples are… meh
You would be much better served reading my “Cypress Advent Calendar 2025” with 25 posts showing equivalent Cy and Pw code / documentation / principles. You could also simply look through the slides and do exercises from my open source workshop “cypress-workshop-cy-vs-pw“. If you want a complete comparison, take my online course “Cypress vs Playwright” and then you know both test runners pretty well.
This month was pretty busy, so just a few posts and videos since the last newsletter
Happy testing!
No posts
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.