iOS 18 does not allow a client application to specify SameSite=None #33164

charliewolfe · 2024-09-05T03:25:25Z

`45ce92c`

iOS 18 does not allow a client application to specify SameSite=None
https://bugs.webkit.org/show_bug.cgi?id=279153
rdar://135312438

Reviewed by Pascoe and Alex Christensen.

In the iOS 18 and macOS Sequoia betas, CFNetwork began treating cookies as SameSite=Lax by default. This
caused an issue where, when WebKit converts from its internal enum `Cookie::SameSitePolicy` to
`NSHTTPCookieStringPolicy`, we return nil for `SameSitePolicy::None`, which CFNetwork now interprets as
lax instead of none.

WebKit should explicitly return none when converting `WebCore::Cookie` to an `NSHTTPCookie`. We should
use a string constant for none, but one is not currently available in the SDK.

* Source/WTF/wtf/PlatformHave.h:
* Source/WebCore/platform/network/cocoa/CookieCocoa.mm:
(WebCore::coreSameSitePolicy):
(WebCore::nsSameSitePolicy):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKHTTPCookieStore.mm:
(TEST(WKHTTPCookieStore, SetSameSiteCookiePolicies)):
(TEST(WKHTTPCookieStore, SetSameSiteCookiePoliciesNonPersistentStore)):

Canonical link: https://commits.webkit.org/283230@main

232cadd

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	✅ 🧪 wincairo-tests
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 jsc-armv7
✅ 🛠 🧪 unsafe-merge	~~🛠 tv~~		✅ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	~~🛠 watch~~
	✅ 🛠 watch-sim

webkit-early-warning-system · 2024-09-05T03:25:31Z

EWS run on previous version of this PR (hash 65bcd8e)

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~	✅ 🧪 wincairo-tests
✅ 🧪 webkitperl	~~🧪 ios-wk2~~	~~🧪 api-mac~~	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	⏳ 🧪 api-ios	✅ 🧪 mac-wk2	~~🛠 gtk~~
	✅ 🛠 vision	~~🧪 mac-AS-debug-wk2~~	❌ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	~~🧪 api-gtk~~
	✅ 🧪 vision-wk2	~~🧪 mac-intel-wk2~~
	~~🛠 tv~~
	✅ 🛠 tv-sim
	~~🛠 watch~~
	✅ 🛠 watch-sim

Source/WebCore/platform/network/cocoa/CookieCocoa.mm

achristensen07 · 2024-09-05T04:18:55Z

Tools/TestWebKitAPI/Tests/WebKitCocoa/WKHTTPCookieStore.mm

+            finished = true;
+        }];
+    }];
+    TestWebKitAPI::Util::run(&finished);


Could you call clearCookies again after this test to leave no state behind?
Also, is it worth adding the same test with a non-persistent data store?
Also, could we test the actual functionality of a same-site:none cookie and see that it is sent correctly over the network?

Could you call clearCookies again after this test to leave no state behind?

Yes.

Also, is it worth adding the same test with a non-persistent data store?

Sure.

Also, could we test the actual functionality of a same-site:none cookie and see that it is sent correctly over the network?

Can you clarify what you mean by this? Do you want me to do that in this test? There are several existing layout tests that verify SameSite=None cookies are sent correctly over the network.

webkit-early-warning-system · 2024-09-05T05:25:07Z

EWS run on previous version of this PR (hash d9ddccf)

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
❌ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	✅ 🧪 wincairo-tests
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	~~🧪 mac-AS-debug-wk2~~	~~🧪 gtk-wk2~~
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2
	✅ 🛠 tv
	✅ 🛠 tv-sim
	~~🛠 watch~~
	✅ 🛠 watch-sim

webkit-early-warning-system · 2024-09-05T07:17:27Z

EWS run on previous version of this PR (hash 596ac99)

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
❌ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~	~~🧪 wincairo-tests~~
✅ 🧪 webkitperl	~~🧪 ios-wk2~~	~~🧪 api-mac~~	~~🧪 api-wpe~~
	~~🧪 ios-wk2-wpt~~	~~🧪 mac-wk1~~	✅ 🛠 wpe-cairo
	⏳ 🧪 api-ios	~~🧪 mac-wk2~~	~~🛠 gtk~~
	✅ 🛠 vision	~~🧪 mac-AS-debug-wk2~~	~~🧪 gtk-wk2~~
	✅ 🛠 vision-sim	~~🧪 mac-wk2-stress~~	~~🧪 api-gtk~~
	~~🧪 vision-wk2~~	~~🧪 mac-intel-wk2~~
	~~🛠 tv~~
	✅ 🛠 tv-sim
	~~🛠 watch~~
	~~🛠 watch-sim~~

webkit-early-warning-system · 2024-09-05T07:19:31Z

EWS run on previous version of this PR (hash 49080f0)

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
❌ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	~~🧪 wpe-wk2~~	✅ 🧪 wincairo-tests
✅ 🧪 webkitperl	~~🧪 ios-wk2~~	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	~~🧪 mac-wk1~~	✅ 🛠 wpe-cairo
	~~🧪 api-ios~~	✅ 🧪 mac-wk2	✅ 🛠 gtk
	✅ 🛠 vision	~~🧪 mac-AS-debug-wk2~~	~~🧪 gtk-wk2~~
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2
	✅ 🛠 tv
	✅ 🛠 tv-sim
	✅ 🛠 watch
	✅ 🛠 watch-sim

chonkate · 2024-09-05T16:34:28Z

Thanks all for looking into this! To ensure our teams and client applications are ready for this change ahead of the release, could I get some clarification on:

The expectation is for app developers to update cookie creation to explicitly include the SameSite policy with a string of none as shown below

let cookieProperties: [HTTPCookiePropertyKey: Any] = [
    .domain: "auth.organization.com",
    .path: "/",
    .name: "sampleCookie",
    .value: "sampleValue",
    .secure: "TRUE",
    .sameSitePolicy: "none",
]

Will the enum https://developer.apple.com/documentation/foundation/httpcookiestringpolicy be updated in the future and the teams can switch to using the enum value instead of the string?
Is it possible app developers to test this change in the impacted iOS apps ahead of release?

achristensen07

This test is sufficient.

Tools/TestWebKitAPI/Tests/WebKitCocoa/WKHTTPCookieStore.mm

webkit-early-warning-system · 2024-09-05T17:32:20Z

EWS run on current version of this PR (hash 232cadd)

Misc	iOS, visionOS, tvOS & watchOS	macOS	Linux	Windows
✅ 🧪 style	✅ 🛠 ios	✅ 🛠 mac	✅ 🛠 wpe	✅ 🛠 wincairo
✅ 🧪 bindings	✅ 🛠 ios-sim	✅ 🛠 mac-AS-debug	✅ 🧪 wpe-wk2	✅ 🧪 wincairo-tests
✅ 🧪 webkitperl	✅ 🧪 ios-wk2	✅ 🧪 api-mac	✅ 🧪 api-wpe
	✅ 🧪 ios-wk2-wpt	✅ 🧪 mac-wk1	✅ 🛠 wpe-cairo
✅ 🛠 🧪 jsc	✅ 🧪 api-ios	✅ 🧪 mac-wk2	✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64	✅ 🛠 vision	✅ 🧪 mac-AS-debug-wk2	✅ 🧪 gtk-wk2
	✅ 🛠 vision-sim	✅ 🧪 mac-wk2-stress	✅ 🧪 api-gtk
	✅ 🧪 vision-wk2	✅ 🧪 mac-intel-wk2	✅ 🛠 jsc-armv7
✅ 🛠 🧪 unsafe-merge	~~🛠 tv~~		✅ 🧪 jsc-armv7-tests
	✅ 🛠 tv-sim
	~~🛠 watch~~
	✅ 🛠 watch-sim

https://bugs.webkit.org/show_bug.cgi?id=279153 rdar://135312438 Reviewed by Pascoe and Alex Christensen. In the iOS 18 and macOS Sequoia betas, CFNetwork began treating cookies as SameSite=Lax by default. This caused an issue where, when WebKit converts from its internal enum `Cookie::SameSitePolicy` to `NSHTTPCookieStringPolicy`, we return nil for `SameSitePolicy::None`, which CFNetwork now interprets as lax instead of none. WebKit should explicitly return none when converting `WebCore::Cookie` to an `NSHTTPCookie`. We should use a string constant for none, but one is not currently available in the SDK. * Source/WTF/wtf/PlatformHave.h: * Source/WebCore/platform/network/cocoa/CookieCocoa.mm: (WebCore::coreSameSitePolicy): (WebCore::nsSameSitePolicy): * Tools/TestWebKitAPI/Tests/WebKitCocoa/WKHTTPCookieStore.mm: (TEST(WKHTTPCookieStore, SetSameSiteCookiePolicies)): (TEST(WKHTTPCookieStore, SetSameSiteCookiePoliciesNonPersistentStore)): Canonical link: https://commits.webkit.org/283230@main

webkit-commit-queue · 2024-09-05T20:31:16Z

Committed 283230@main (45ce92c): https://commits.webkit.org/283230@main

Reviewed commits have been landed. Closing PR #33164 and removing active labels.

charliewolfe self-assigned this Sep 5, 2024

charliewolfe added the New Bugs Unclassified bugs are placed in this component until the correct component can be determined. label Sep 5, 2024

pascoej approved these changes Sep 5, 2024

View reviewed changes

achristensen07 requested changes Sep 5, 2024

View reviewed changes

charliewolfe force-pushed the eng/iOS-18-does-not-allow-a-client-application-to-specify-SameSiteNone branch from 65bcd8e to d9ddccf Compare September 5, 2024 05:25

charliewolfe requested a review from achristensen07 September 5, 2024 05:25

charliewolfe force-pushed the eng/iOS-18-does-not-allow-a-client-application-to-specify-SameSiteNone branch from d9ddccf to 596ac99 Compare September 5, 2024 07:17

charliewolfe force-pushed the eng/iOS-18-does-not-allow-a-client-application-to-specify-SameSiteNone branch from 596ac99 to 49080f0 Compare September 5, 2024 07:19

charliewolfe force-pushed the eng/iOS-18-does-not-allow-a-client-application-to-specify-SameSiteNone branch 2 times, most recently from 1b5edda to 8f84319 Compare September 5, 2024 08:44

WebKit deleted a comment from webkit-early-warning-system Sep 5, 2024

achristensen07 approved these changes Sep 5, 2024

View reviewed changes

Tools/TestWebKitAPI/Tests/WebKitCocoa/WKHTTPCookieStore.mm Outdated Show resolved Hide resolved

charliewolfe force-pushed the eng/iOS-18-does-not-allow-a-client-application-to-specify-SameSiteNone branch from 8f84319 to 232cadd Compare September 5, 2024 17:32

charliewolfe added the unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing label Sep 5, 2024

webkit-commit-queue force-pushed the eng/iOS-18-does-not-allow-a-client-application-to-specify-SameSiteNone branch from 232cadd to 45ce92c Compare September 5, 2024 20:31

webkit-commit-queue merged commit 45ce92c into WebKit:main Sep 5, 2024

webkit-commit-queue removed the unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing label Sep 5, 2024

xueyuanl mentioned this pull request Sep 20, 2024

Daily Hacker News 20-09-2024 xueyuanl/daily-hackernews#1453

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

iOS 18 does not allow a client application to specify SameSite=None #33164

iOS 18 does not allow a client application to specify SameSite=None #33164

charliewolfe commented Sep 5, 2024 •

edited by webkit-early-warning-system

Loading

webkit-early-warning-system commented Sep 5, 2024 •

edited

Loading

achristensen07 Sep 5, 2024

charliewolfe Sep 5, 2024 •

edited

Loading

webkit-early-warning-system commented Sep 5, 2024 •

edited

Loading

webkit-early-warning-system commented Sep 5, 2024 •

edited

Loading

webkit-early-warning-system commented Sep 5, 2024 •

edited

Loading

chonkate commented Sep 5, 2024

achristensen07 left a comment

webkit-early-warning-system commented Sep 5, 2024 •

edited

Loading

webkit-commit-queue commented Sep 5, 2024

iOS 18 does not allow a client application to specify SameSite=None #33164

iOS 18 does not allow a client application to specify SameSite=None #33164

Conversation

charliewolfe commented Sep 5, 2024 • edited by webkit-early-warning-system Loading

45ce92c

webkit-early-warning-system commented Sep 5, 2024 • edited Loading

achristensen07 Sep 5, 2024

Choose a reason for hiding this comment

charliewolfe Sep 5, 2024 • edited Loading

Choose a reason for hiding this comment

webkit-early-warning-system commented Sep 5, 2024 • edited Loading

webkit-early-warning-system commented Sep 5, 2024 • edited Loading

webkit-early-warning-system commented Sep 5, 2024 • edited Loading

chonkate commented Sep 5, 2024

achristensen07 left a comment

Choose a reason for hiding this comment

webkit-early-warning-system commented Sep 5, 2024 • edited Loading

webkit-commit-queue commented Sep 5, 2024

charliewolfe commented Sep 5, 2024 •

edited by webkit-early-warning-system

Loading

`45ce92c`

webkit-early-warning-system commented Sep 5, 2024 •

edited

Loading

charliewolfe Sep 5, 2024 •

edited

Loading

webkit-early-warning-system commented Sep 5, 2024 •

edited

Loading

webkit-early-warning-system commented Sep 5, 2024 •

edited

Loading

webkit-early-warning-system commented Sep 5, 2024 •

edited

Loading

webkit-early-warning-system commented Sep 5, 2024 •

edited

Loading