Cordova mobile app with ionic-webview fails to store/retry session cookies in iOS 14 WkWebview

4
votes

I am using iOS 14 Device/Simulator for my Cordova Mobile App which uses cordova-plugin-ionic-webview with WkWebView Settings on.

I have following option set in config.xml

<access origin="myapp://mobileapp" />
<allow-navigation href="myapp://mobileapp" />

which makes all my xhr call to have "origin:myapp://mobileapp" header. I have defined all CORS header appropriately.

Now my authentication XHR calls has 2 APIs (a)authentication and (b) step up operation. API (b) will use HTTPOnly secure cookies set by API (a) in order to respond appropriately.

Both of the above APIs works perfectly fine with UIWebview, iOS 13.5, iOS 13.7 simulator and devices. However fails in iOS 14, iOS 13.3. When analyzing I am seeing that cookies sent in API (a) are not stored in WkWebview and hence they are not sent while calling API (b). So second API fails to complete.

I have seen cookies ignored in first execution, tracking prevention and wkwebview bug but could not identify the issue.

APIs work well when I use them In-AppBrowser with WkWebview, but only fails in main cordova view.

Do I have to set any special settings in ionic-webviw plugin while using a cusotm origin and Cross platform XHR call ?

My XHR calls are made to "*https://mydomain.app.com/api/firstapi*" and "*https://mydomain.app.com/api/secondapi*", while firstapi will send header "set-cookie" with domain set to ".app.com". So when we are making XHR calls with custom origin these kind of cookies will be treated as third party cookies or first party cookie?

Any help here will be extremely helpful. I am looking for proper way of implementing Cordova+WkWebView+XHR login calls with HTTPOnly cookies

1
ioscordovacookieswkwebviewcordova-plugin-ionic-webview
It was Xcode 12 !. XCode 12 broke cookie syncing. – Girish Adiga
FYI, since the 26th of April 2021, it's no longer possible to release an app to App Store built with Xcode 11. – Mathieu Castets

1 Answers

1
votes

XCode 12 + iOS 14 Permanently stopped syncing third party cookies with the introduction to Intelligent Tracking Prevention technology. Apple's solution for this is to go with App Bound domain.

Unfortunately there is nothing we can do to fix as of now. There are plugins like nativeXHR which tries to solve by routing API calls to native code, but does not sync cookie to cordova instance of wkwebview.

Update:

Cookies can still be synced if one wants to use just one server. Set below preference in config.xml to match your domain. In this way origin will be set to app://yourdomain.com. Thus wkwebview will sync cookies with domain/subdomain *.yourdomain.com.

<preference name="scheme" value="https" />
<preference name="hostname" value="yourdomain.com" />