cypress vs 9 with electron as browser seems to ignore chrome websecurity options

[pmerwin]

We run our site as http in our github actions and all works great with chrome, and was fine with electron until vs 9.

With vs 9 on electron we get CORS issues and our endpoint returns an unauthorized to electron, but all is well with chrome 96 and FF.
Explained here:

https://share.getcloudapp.com/YEuP0GPz

...also, going back to cy 8.6 works.

cypress/integration/adept.bookshelf.assigned.spec.js:
    Test that a user can get to bookshelf content -> Can see open bookshelf and see assigned content
      cy:intercept (K): Method: POST
                        Matcher: "https://api.adept.at/communication/graphql"
                        Mocked Response: req => {
                            const {
                              body
                            } = req;
                            if (body.hasOwnProperty('query') && body.query.includes(opName)) {
                              req.alias = opName;
                            }
                          }
      cy:intercept (K): Method: POST
                        Matcher: "https://api.adept.at/content/graphql"
                        Mocked Response: req => {
                            const {
                              body
                            } = req;
                            if (body.hasOwnProperty('query') && body.query.includes(opName)) {
                              req.alias = opName;
                            }
                          }
      cy:intercept (K): Method: POST
                        Matcher: "https://api.adept.at/accounts/graphql"
                        Mocked Response: req => {
                            const {
                              body
                            } = req;
                            if (body.hasOwnProperty('query') && body.query.includes(opName)) {
                              req.alias = opName;
                            }
                          }
      cy:intercept (K): Method: POST
                        Matcher: "https://api.adept.at/content/graphql"
                        Mocked Response: req => {
                            const {
                              body
                            } = req;
                            if (body.hasOwnProperty('query') && body.query.includes(opName)) {
                              req.alias = opName;
                            }
                          }
      cy:intercept (K): Method: GET
                        Matcher: "https://api.adept.at/web/token"
        cy:command (K): visit	/login
         cons:warn (!): LD: [warn] Error on stream connection: {"isTrusted":true}, will continue retrying every 1000 milliseconds.
            cy:xhr (K): GET https://app.launchdarkly.com/sdk/goals/6019d8cd3db0be0a0a8b9fe6
                        Status: 200 - OK
            cy:xhr (K): GET https://app.launchdarkly.com/sdk/evalx/6019d8cd3db0be0a0a8b9fe6/users/eyJrZXkiOiJhbm9ueW1vdXNfdXNlcl9rZXkifQ
                        Status: 200 - OK
            cy:xhr (K): POST https://events.launchdarkly.com/events/diagnostic/6019d8cd3db0be0a0a8b9fe6
                        Status: 202 - Accepted
        cy:command (K): get	#email
        cy:command (K): assert	expected **#email** to be **visible**
        cy:command (K): type	[email protected]
            cy:xhr (K): POST https://www.google-analytics.com/j/collect?v=1&_v=j96&a=25852846&t=pageview&_s=1&dl=http://learn.adept.at/login&ul=en-us&de=UTF-8&dt=Adept.at&sd=30-bit&sr=1792x1120&vp=1000x660&je=0&_u=YEBAAEABAAAAAC\x7e&jid=892614588&gjid=756033331&cid=869572762.1638386553&tid=UA-164164352-1&_gid=1702836116.1638386553&_r=1&gtm=2wgb80K7Q3ZML&z=124655543 (47 ms)
                        Status: 200 - OK
        cy:command (K): get	#password
        cy:command (K): type	Adept123!
        cy:command (K): get	#login-button
        cy:command (K): click
            cy:xhr (K): POST https://api.adept.at/web/login
                        Status: 200 - OK
        cy:command (K): wait	@token
          cy:fetch (!): (token) GET https://api.adept.at/web/token
                        Status: 401
                        Response body: {
                          "message": "Unauthorized"
                        }
        cons:error (X): Error: Unable to retrieve token for session
                            at http://learn.adept.at:3000/static/js/main.3c7568fd.chunk.js:2:943694
                            at l (http://learn.adept.at:3000/static/js/48.c6561fb2.chunk.js:2:2620329)
                            at Generator._invoke (http://learn.adept.at:3000/static/js/48.c6561fb2.chunk.js:2:2620082)
                            at Generator.next (http://learn.adept.at:3000/static/js/48.c6561fb2.chunk.js:2:2620692)
                            at r (http://learn.adept.at:3000/static/js/48.c6561fb2.chunk.js:2:328866)
                            at s (http://learn.adept.at:3000/static/js/48.c6561fb2.chunk.js:2:329069)
        cy:command (X): its	.response.body
        cy:command (X): assert	expected **{ message: Unauthorized }** to have property **accessToken**
          cy:fetch (!): POST https://api.adept.at/web/sessionRefresh
                        Status: 500
            cy:xhr (K): POST https://events.launchdarkly.com/events/bulk/6019d8cd3db0be0a0a8b9fe6
                        Status: 202 - Accepted
        cons:error (X): Error: Unable to refresh token for session
                            at http://learn.adept.at:3000/static/js/main.3c7568fd.chunk.js:2:944350
                            at l (http://learn.adept.at:3000/static/js/48.c6561fb2.chunk.js:2:2620329)
                            at Generator._invoke (http://learn.adept.at:3000/static/js/48.c6561fb2.chunk.js:2:2620082)
                            at Generator.next (http://learn.adept.at:3000/static/js/48.c6561fb2.chunk.js:2:2620692)
                            at r (http://learn.adept.at:3000/static/js/48.c6561fb2.chunk.js:2:328866)
                            at s (http://learn.adept.at:3000/static/js/48.c6561fb2.chunk.js:2:329069)
        cy:command (K): task	failFastLog, Enabling skip mode
        cy:command (K): task	failFastShouldSkip, true
        ```

[pmerwin]

Hmmm interesting with electron, no cookie or content/storage headers are sent in the request vs chrome (which works)...

our app is not setting those that has to be cypress or electron not including those?

Electron (fails):
Accept: /
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Connection: keep-alive
Host: api.adept.at
Referer: http://learn.adept.at:3000/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
User-Agent: Adept
x-datadog-origin: rum
x-datadog-parent-id: 2670188163476211859
x-datadog-sampled: 1
x-datadog-sampling-priority: 1
x-datadog-trace-id: 6190204999158093994

---

Chrome ( succeeds )
Accept: application/json, text/plain, /
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Content-Length: 71
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Cookie: removed by me for security
Host: api.adept.at
Referer: http://learn.adept.at:3000/
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="96", "Google Chrome";v="96"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "macOS"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
User-Agent: Adept
x-datadog-origin: rum
x-datadog-parent-id: 9059599271481811950
x-datadog-sampled: 1
x-datadog-sampling-priority: 1
x-datadog-trace-id: 2025085556435353620