How to Restore a User's Session and Set API Token for Hotwire HTML Page Requests

[jspooner]

In our iOS native app using Hotwire, we manage user sign-in through native screens and securely store the API token in the Keychain.

Setting API Token for Hotwire Requests: How can we configure Hotwire to include the API token (retrieved from the Keychain) in all requests for HTML page views? Specifically, how do we attach the token to request headers or authenticate Turbo-driven HTML content? Are we extending a base HTTP library, or is there a setter method or configuration in a Hotwire/Turbo class that handles this?

Code examples or references to relevant Hotwire/Turbo iOS documentation would be greatly appreciated!

It seems JumpStartPro is doing what I'm asking.

[joemasilotti]

I don't think this is currently possible.

Jumpstart doesn't do native authentication anymore, everything is handled via web views. So the cookie when signing in is used (without developer intervention) for future Hotwire Native web requests.

If I have to implement native auth screens for clients I recommend no API token. Instead, I send a cookie in the JSON response that I then copy over to WebKit world for Hotwire Native to use automatically.

[jspooner]

I prototyped a solution using standard Devise HTML forms to test persisting user sessions across app sessions by saving and restoring a cookie. Saving the cookie to the Keychain and restoring it was straightforward, but the cookie was not being sent to the server. After reading your blog post, I discovered the session.reload method, which resolved the issue by triggering the cookie to be sent to the server.

I'm new to the Turbo Swift classes and unclear on how cookies interact with the view lifecycle. I assumed setting the cookie in HTTPCookieStorage and WKWebsiteDataStore before calling tabBarController.load would suffice, but it doesn't work without session.reload.

Here’s the code where I save the cookie during navigation:

extension SceneDelegate: NavigatorDelegate {
  func handle(
    proposal: VisitProposal,
    from navigator: Navigator) -> ProposalResult
  {
    // Save cookie to Keychain and log properties during navigation
   let webView = navigator.session.webView
    webView.configuration.websiteDataStore.httpCookieStore.getAllCookies { cookies in
      for cookie in cookies {
        print("Name: \(cookie.name), Value: \(cookie.value), Domain: \(cookie.domain), Path: \(cookie.path), Expires: \(cookie.expiresDate?.description ?? "None"), IsSecure: \(cookie.isSecure), IsHTTPOnly: \(cookie.isHTTPOnly)")
        if cookie.name == "_prayai_web_session" {
          let keychain = Keychain(service: Bundle.main.bundleIdentifier! + ".keychain")
          keychain[string: cookie.name] = cookie.value
          print("Saved to Keychain: \(cookie.name)=\(cookie.value)")
        }
      }
    }
    navigator.session.reload()
    return switch proposal.viewController {
    case "prayer": .acceptCustom(PrayerController(url: proposal.url))
    default: .accept
    }
  }
}

And here’s where I restore the cookie when the scene loads:

class SceneDelegate: UIResponder, UIWindowSceneDelegate {
  var window: UIWindow?
  private lazy var tabBarController = HotwireTabBarController(navigatorDelegate: self)

  func scene(
    _ scene: UIScene,
    willConnectTo session: UISceneSession,
    options connectionOptions: UIScene.ConnectionOptions)
  {
    restoreCookieFromKeychain()
    window?.rootViewController = tabBarController
    tabBarController.load(HotwireTab.all)
  }

  private func restoreCookieFromKeychain() {
    let keychain = Keychain(service: Bundle.main.bundleIdentifier! + ".keychain")
    let cookieName = "_prayai_web_session"
    let cookieValue = keychain[string: cookieName] ?? ""
    print("Cookie Value from Keychain: \(cookieValue)")

    // Construct the Set-Cookie header
    let headers = [
      "Set-Cookie": "\(cookieName)=\(cookieValue); Path=/; HttpOnly; SameSite=Lax"
    ]
    let cookies = HTTPCookie.cookies(withResponseHeaderFields: headers, for: URL(string: "http://localhost")!)

    // Set cookies in HTTPCookieStorage
    HTTPCookieStorage.shared.setCookies(cookies, for: URL(string: "http://localhost")!, mainDocumentURL: nil)
    print("Cookies set in HTTPCookieStorage: \(HTTPCookieStorage.shared.cookies ?? [])")

    // Set cookies in WKWebsiteDataStore
    let cookieStore = WKWebsiteDataStore.default().httpCookieStore
    cookies.forEach { cookie in
      cookieStore.setCookie(cookie) {
        print("Cookie set in WKWebsiteDataStore: \(cookie.name) = \(cookie.value)")
      }
    }
  }
}

Could you clarify why session.reload is necessary for the cookie to be sent to the server? How do cookies interact with Turbo's session and view lifecycle? Is there a better way to ensure the restored cookie is applied without needing session.reload?

[joemasilotti]

My guess is that there is some asynchronous behavior going on. getAllCookies returns on a background thread. So by the time the cookie is set on the keychain the initial request has already completed. Calling reload() happens after the cookie is set, so it correctly works.

Taking a step back, why are you storing the cookie in the keychain at all? Why not write it directly to the web view cookie jar after it's retrieved from the native authentication?