apache / apache/cordova-ios

Cookies are blocked in iframe even after disabling ITP

Open
#1,228 11 comments 1 reaction 0 assignees View on GitHub
webkit bug
Dominant language
JavaScript
Stars
2.2k
Forks
1k
Avg merge
12h 11m
Merged PRs (30d)
18

Description

# Bug Report

## Problem
Even after allowing cross-site tracking in the app setting to disable ITP, the 3rd party cookies are still not being set in iframe. The Storage Access API denies the request to access storage. This causes login to fail in the iframe.

### What is expected to happen?
Cookies should be stored and sent in every request

### What does actually happen?
Cookies are not being stored

## Information

I have created a sample application to illustrate the problem. Link - https://github.com/abhinavms/cordova-3rdparty-cookie

The webview loads URL [abhinavms.github.io/cookieTest](https://abhinavms.github.io/cookieTest/). It has an iframe that loads [cookie-set-test.herokuapp](https://cookie-set-test.herokuapp.com/) ([Source code](https://github.com/abhinavms/cookie)). [cookie-set-test.herokuapp](https://cookie-set-test.herokuapp.com/) sends a request to set a cookie and verify if the cookie was set. It also displays if the Storage Access API has granted access.

With the latest Xcode version, it is observed that the cookie is never being set in the iframe unless already a first-party cookie was available. This issue was also reproducible in iOS 12.4, which doesn't have ITP

Observations
1. The iframe does not have the Storage Access API, therefore cookies are not being stored
2. document.requestStorageAccess() is denying the request to access storage to save cookies
3. If the 3rd party domain already has a 1st party cookie, then storage access is given and it can load in the iframe

### Environment, Platform, Device

Xcode 13.3
iOS 15.3, 12.4

## Checklist

- [x] I searched for existing GitHub issues
- [x] I updated all Cordova tooling to most recent version
- [x] I included all the necessary information above

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the linked sample application, its iframe, and the cookie-setting service on iOS 15.3 and 12.4 using Xcode 13.3. Start by inspecting the iframe's Storage Access API behavior and verify that the fix allows third-party cookies to be stored and sent when cross-site tracking is disabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, javascript
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.