Cookies are blocked in iframe even after disabling ITP
- Dominant language
- JavaScript
- Stars
- 2.2k
- Forks
- 1k
- Avg merge
- 12h 11m
- Merged PRs (30d)
- 18
Description
# Bug Report
## Problem
Even after allowing cross-site tracking in the app setting to disable ITP, the 3rd party cookies are still not being set in iframe. The Storage Access API denies the request to access storage. This causes login to fail in the iframe.
### What is expected to happen?
Cookies should be stored and sent in every request
### What does actually happen?
Cookies are not being stored
## Information
I have created a sample application to illustrate the problem. Link - https://github.com/abhinavms/cordova-3rdparty-cookie
The webview loads URL [abhinavms.github.io/cookieTest](https://abhinavms.github.io/cookieTest/). It has an iframe that loads [cookie-set-test.herokuapp](https://cookie-set-test.herokuapp.com/) ([Source code](https://github.com/abhinavms/cookie)). [cookie-set-test.herokuapp](https://cookie-set-test.herokuapp.com/) sends a request to set a cookie and verify if the cookie was set. It also displays if the Storage Access API has granted access.
With the latest Xcode version, it is observed that the cookie is never being set in the iframe unless already a first-party cookie was available. This issue was also reproducible in iOS 12.4, which doesn't have ITP
Observations
1. The iframe does not have the Storage Access API, therefore cookies are not being stored
2. document.requestStorageAccess() is denying the request to access storage to save cookies
3. If the 3rd party domain already has a 1st party cookie, then storage access is given and it can load in the iframe
### Environment, Platform, Device
Xcode 13.3
iOS 15.3, 12.4
## Checklist
- [x] I searched for existing GitHub issues
- [x] I updated all Cordova tooling to most recent version
- [x] I included all the necessary information above
Contributor guide
Research direction
Reproduce the issue with the linked sample application, its iframe, and the cookie-setting service on iOS 15.3 and 12.4 using Xcode 13.3. Start by inspecting the iframe's Storage Access API behavior and verify that the fix allows third-party cookies to be stored and sent when cross-site tracking is disabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ios, javascript
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100