diff --git a/docs/api/commands/origin.mdx b/docs/api/commands/origin.mdx
index d98a40bd00..9d8f5f89e9 100644
--- a/docs/api/commands/origin.mdx
+++ b/docs/api/commands/origin.mdx
@@ -3,8 +3,8 @@ title: origin
e2eSpecific: true
---
-Visit multiple domains of different
-[origin](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#definition_of_an_origin)
+Visit multiple different
+[origins](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#definition_of_an_origin)
in a single test.
In normal use, a single Cypress test may only run commands in a single origin, a
@@ -28,6 +28,18 @@ doc.
:::
+:::info
+
+Changes in Cypress [v14.0.0](/app/references/changelog#14-0-0)
+
+Cypress no longer injects `document.domain` by default, which means `cy.origin()`
+must now be used to navigate between any two origins in the same test, even if
+the two origins are in the same superdomain. This behavior can be disabled by setting
+the `injectDocumentDomain` configuration option to `true`, to allow a smooth transition
+of tests to the new behavior. In Cypress 15, this configuration option will be removed.
+
+:::
+
## Syntax
```js
@@ -63,26 +75,28 @@ cy.get('h1').contains('My cool site under test')
const hits = getHits()
cy.visit('https://example.cypress.io/history/founder')
// To interact with cross-origin content, move this inside cy.origin() callback
-cy.get('h1').contains('About our Founder')
-// Domain must be a precise match including subdomain, i.e. example.cypress.io
-cy.origin('cypress.io', () => {
- cy.visit('/history/founder')
- cy.get('h1').contains('About our Founder')
- // Fails because hits is not passed in via args
- cy.get('#hitcounter').contains(hits)
+cy.get('h1').contains('Kitchen Sink')
+// Origin must be a precise match including scheme, subdomain and port, i.e. https://www.cypress.io
+cy.origin('https://www.cypress.io', () => {
+ cy.visit('/about-us')
+ cy.get('h1').contains('About us')
+ // Fails because doanloads is not passed in via args
+ cy.contains(downloads)
})
-// Won't work because still on cypress.io
-cy.get('h1').contains('My cool site under test')
+// Won't work because still on www.cypress.io
+cy.get('h1').contains('Kitchen Sink')
```
### Arguments
- **url _(String)_**
+ **origin _(String)_**
-A URL specifying the secondary origin in which the callback is to be executed.
-This should at the very least contain a hostname, and may also include the
-protocol, port number & path. The hostname must precisely match that of the
-secondary origin, including all subdomains. Query params are not supported.
+A string specifying the origin in which the callback is to be executed.
+This should at the very least contain a hostname. It may also include the
+scheme and port number. The path may be included, but is not necessary.
+The hostname must precisely match that of the secondary origin, including
+all subdomains. Query params are not supported. If no scheme is provided,
+the scheme defaults to `https`.
This argument will be used in two ways:
@@ -542,6 +556,7 @@ inclusion in a future version of Cypress.
| Version | Changes |
| ------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| [14.0.0](/app/references/changelog#14-0-0) | `cy.origin()` is now required when navigating between origins in the same test, rather than superdomains. |
| [12.6.0](/app/references/changelog#10-7-0) | Support for `Cypress.require()` added and support for CommonJS `require()` and ES module `import()` removed |
| [10.11.0](/app/references/changelog#10-7-0) | Support for CommonJS `require()` and ES module `import()` added and support for `Cypress.require()` removed |
| [10.7.0](/app/references/changelog#10-7-0) | Support for `Cypress.require()` added |
diff --git a/docs/app/faq.mdx b/docs/app/faq.mdx
index 28a0798a30..d8bfc15aaa 100644
--- a/docs/app/faq.mdx
+++ b/docs/app/faq.mdx
@@ -452,7 +452,7 @@ a remote page and does not resolve until all of the external resources complete
their loading phase. Because we expect your applications to observe differing
load times, this command's default timeout is set to 60000ms. If you visit an
invalid url or a
-[second unique domain](/app/guides/cross-origin-testing#Different-superdomain-per-test-requires-cyorigin),
+[second unique domain](/app/guides/cross-origin-testing#Different-origins-per-test-require-cyorigin),
Cypress will log a verbose yet friendly error message.
**_In CI, how do I make sure my server has started?_**
diff --git a/docs/app/guides/cross-origin-testing.mdx b/docs/app/guides/cross-origin-testing.mdx
index 5f67abeadc..ce0c74e719 100644
--- a/docs/app/guides/cross-origin-testing.mdx
+++ b/docs/app/guides/cross-origin-testing.mdx
@@ -31,9 +31,6 @@ and we are _mostly_ able to do this.
### What Cypress does under the hood
-- Injects
- [`document.domain`](https://developer.mozilla.org/en-US/docs/Web/API/Document/domain)
- into `text/html` pages.
- Proxies all HTTP / HTTPS traffic.
- Changes the hosted URL to match that of the application under test.
- Uses the browser's internal APIs for network level traffic.
@@ -55,7 +52,7 @@ Cypress must assign and manage browser certificates to be able to
modify the traffic in real time. You'll notice Chrome display a warning that the 'SSL certificate does not
match'. This is expected behavior. Under the hood we act as our own CA
authority and issue certificates dynamically in order to intercept requests
-otherwise impossible to access. We only do this for the superdomain currently
+otherwise impossible to access. We only do this for the origin currently
under test, and bypass other traffic.
Note, that Cypress allows you to optionally specify CA / client certificate
@@ -72,39 +69,37 @@ It's important to note that although we do our **very best** to ensure your
application works normally inside of Cypress, there _are_ some limitations you
need to be aware of.
-- [Different superdomain per test requires cy.origin command](#Different-superdomain-per-test-requires-cyorigin)
+- [Different origins per test require cy.origin()](#Different-origins-per-test-require-cyorigin)
- [Cross-origin iframes are not supported](#Cross-origin-iframes)
- [Navigating from HTTPS to HTTP will error](#Insecure-Content)
- [Cypress requires that the URLs navigated to have the same port](#Same-port-per-test)
-### Different superdomain per test requires cy.origin
+### Different origins per test require `cy.origin()`
Cypress changes its own host URL to match that of your applications. With the
exception of `cy.origin`, Cypress requires that the URLs navigated to have the
-[same superdomain](/app/guides/cross-origin-testing#Parts-of-a-URL) for the
+[origin](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin) for the
entirety of a single test.
-If you attempt to visit two different superdomains, the `cy.origin` command must
+If you attempt to visit two different origins, the `cy.origin` command must
be used to wrap Cypress commands of the second visited domain. Otherwise,
Cypress commands will timeout after the navigation and will eventually error.
This is because the commands that were expected to run on the second domain are
actually being run on the first domain.
-Without `cy.origin`, you can visit different superdomains in _different_ tests,
-but not in the _same_ test. Please read our
-[Cross Origin Testing Guide](/app/guides/cross-origin-testing) for more
-information.
+Without `cy.origin()`, you can visit different origins in _different_ tests,
+but not in the _same_ test.
#### Examples of test cases that will error without the use of `cy.origin`
1. [`.click()`](/api/commands/click) an `` with an `href` to a different
- superdomain with subsequent Cypress commands being run.
+ origin with subsequent Cypress commands being run.
2. [`.submit()`](/api/commands/submit) a `