Clear credentials from UIWebView with JavaScript

Question

Some context:

This is a rails 4.2 web app using devise and omniauth-facebook which sets true for apple-mobile-web-app-capable

From a URL in Safari, users can add the web app to their iOS device's home screen.

The issue here is that when users login w/ Facebook for the second time, it authenticates with the same user as before, even if the user logged out from the web app and from Facebook in Safari.

In other words, once you login with Facebook, the web app(UIWebView), applies the same credentials every time. Regardless of your Facebook's current user in Safari or if you logged out from the web app.

That happens even if the web app - UIWebView got removed from the iOS device's home screen.

This functionality works fine from browsers - Safari, Mobile Safari, and Chrome.

I found that Safari and UIWebView save data in different places, but not sure how to access UIWebView data (cookies/session/credentials) to remove it.

I would like to do that via JavaScript. However, I'm open to other options. Just please take in consideration that this is a Rails app.

The code:

Gemfile

gem "rails",              "~> 4.2"
gem "devise",             "~> 3.5"
gem "omniauth-facebook",  "~> 3.0"

application.html.haml

%head
  %meta{ name: "apple-mobile-web-app-capable", content: "yes" }/

view (HAML)

= link_to destroy_user_session_path, method: :delete do
  .css_classes Sign Out

sessions_controller.rb - from Devise

def destroy
  super
  cookies.clear
end

JAL JAL · Accepted Answer · 2016-06-08T14:36:46

UIWebView cookies are generally stored in NSHTTPCookieStorage.sharedHTTPCookieStorage().cookies. There are some other goodies stored in that singleton as well. I have a few ideas:

Verify that in fact your ruby call is clearing the cookies by logging out and then logging all of the cookies in sharedHTTPCookieStorage. If the cookies aren't cleared, clear them manually.
The device's Safari settings may be interfering with the storage and removal of cookies. Verify your cookie accept policy: NSHTTPCookieStorage.sharedHTTPCookieStorage().cookieAcceptPolicy = NSHTTPCookieAcceptPolicy.Always
Consider using a WKWebView and the not-so-documented WKProcessPool to flush and manage cookies.

I realize these are not pure JavaScript options. I'm not sure if what you're asking is possible via the JavaScript bridge.

Clear credentials from UIWebView with JavaScript

1 Answers