Sign in does not work on Safari

[Eakam1007]

Local Environment

After clicking the Sign In button to localhost on safari, the following is shown. Safari uses https but even after manually changing it to http, the login page is shown again:
(Video provided by @Genne23v)

Untitled.video.mp4

Test Environment

This also resulted in these failed tests: https://github.com/DevelopingSpace/starchart/actions/runs/4213508191. The tests fail for Desktop (webkit) and Mobile Safari

Please ignore the failed test for chrome since that was due to missing wait time for sign in.

A video of the failed test run, taken from the above link (download the playwright report artifact, look under failed tests, and retry#1)

a50b4d7c21b57a9d4ed5dce703fd41a41e72173f.mp4

Some investigation is required to find out what is happening here. It seems like the Sign in button is clicked but no redirect happens.

[humphd]

Why are you using https?

[Eakam1007]

Oh, I missed that yesterday. My guess is safari defaults to https. Will have to check this again by manually specifying http

However, for the test environment, the base url does not use https:
baseURL: `http://localhost:${process.env.PORT}`,

[Eakam1007]

I have updated the screenshot with a video as per this discussion

Safari changes http to https after the Sign in button is clicked, and does not redirect to home page

[humphd]

I think this is CSP related. We are sending the upgrade-insecure-requests header. Do you want to try doing this in server.ts, see https://github.com/DevelopingSpace/starchart/blob/main/server.ts#L29-L41:

helmet.contentSecurityPolicy({
    useDefaults: false,
    directives: {
      ...
      upgradeInsecureRequests: null,
    },
  })

That would disable it, and if it works, we could then make it work only for development.

[Eakam1007]

Hmmm, doesn't seem to work in the testing environment. Wasn't able to test it on Safari though outside of testing