Search code examples
javascripttypescriptgithubplaywright

Cannot automate Playwright tests with GitHub authentication - prompted to email code verification

I'm writing automation tests for my web application. One of the step is to complete authentication in my app. To do so, there is a button for GitHub authentication. I'm using GitHub OAuth app.

When my automation test runs, I successfully fill the account details: username & password. However, after completing this step, it requires me to enter verification code sent to my email from GitHub. This prevents me from completing the test.

If I take a look in this documentation: https://playwright.dev/docs/auth This issue is not even stated, so I think there is some issue with my code/account/configuration.

This is my running test:

        await page.goto('/');
        await page.getByTestId('auth-github-auth-button').click();

        await page.getByLabel('Username or email address').fill('feggfd@dfgsdfgsdfgdfgsd');
        await page.getByLabel('Password').fill('jopjopopjopjopj');
        await page.getByRole('button', { name: 'Sign in' }).click();

I'm running my test with script playwright test, and this is my playwright.config.ts file:

import { defineConfig } from '@playwright/test';

const configuration = defineConfig({
    testDir: './tests',
    testIgnore: 'scripts',
    globalSetup: './tests/scripts/global-setup.ts',
    globalTeardown: './tests/scripts/global-teardown.ts',
    reporter: [['html', { open: 'never' }]],
    use: {
        testIdAttribute: 'data-testid',
        baseURL: 'http://localhost:8080',
        storageState: './tests/storage/storage-state.json',
    },
});

export default configuration;

I debugged the automation using playwright test --debug, and I did see the automation successfully enters the credentials, but then prompted to enter verification code: enter image description here

Solution

  • This is pretty much standard when you're logging into GitHub and you haven't enabled two-factor authentication. The reason is that some people reuse passwords or pick commonly used passwords and this makes it harder to brute-force things.

    You have a couple of choices here. First, you could create an account with 2FA using TOTP and use a TOTP library to generate the code. In all likelihood, you'll have to extract the key from the QR code, though. Note that in any case, you should avoid checking the credentials (username, password, TOTP secret) into your codebase, because if your code is ever accidentally exposed (which is quite common), your credentials will as well.

    You could also set up some sort of IMAP access to the email account and read the email from the account, and fill that in.

    Either way, you're going to need more than just a username and password to log into GitHub these days.