Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SameSite cookies missing from HTTP requests (includes reduced test-case) #134

Closed
steffenweber opened this issue Jul 3, 2019 · 3 comments
Closed

SameSite cookies missing from HTTP requests (includes reduced test-case) #134

steffenweber opened this issue Jul 3, 2019 · 3 comments
Labels
bug Something isn't working

Comments

@steffenweber
Copy link

There is a bug in Kiwi Browser with the handling of SameSite cookies: SameSite cookies are missing from HTTP requests sent by Kiwi. I've created a reduced test-case.

How to reproduce:

  1. Open https://www.computerbase.de/kiwi-samesite-cookie-bug.php (the page sets two cookies "normal-cookie" and "samesite-cookie")
  2. Reload the page (such that the cookies are sent back to the server)

What should happen: The page should display the values of both cookies.

What actually happens: The page only shows the value of "normal-cookie" but not the value of "samesite-cookie".

This works in all other browsers (Chrome, Firefox, Edge, Opera, Safari, …) except for Kiwi. I've tested in Kiwi Browser 75.0.3770.101 on a Pixel 3. Could you please have a look? :)

This issue was originally reported by one of our users because he/she is unable to login to our website using Kiwi Browser: https://www.computerbase.de/forum/threads/kiwi-browser-kein-einloggen-moeglich.1879841/

This is the source code of the test-case (requires PHP 7.3 for "samesite" support in "setcookie"):

<?php
setcookie('normal-cookie', '42');
setcookie('samesite-cookie', '42', ['samesite' => 'Lax']);
?>
<!DOCTYPE html>
<html>
<head>
	<title>Kiwi SameSite Cookie Bug</title>
</head>
<body>
<h1>Kiwi SameSite Cookie Bug</h1>
<ul>
	<li>normal-cookie: <?php echo htmlspecialchars($_COOKIE['normal-cookie'] ?? '-'); ?></li>
	<li>samesite-cookie: <?php echo htmlspecialchars($_COOKIE['samesite-cookie'] ?? '-'); ?></li>
</ul>
</body>
</html>
@IT-Gandalf
Copy link

Any Updates to this issue from the Dev Team? @kiwibrowser

@7lives83
Copy link

Problem still exists. Dev Team?
Why Kiwi cant handele sametime-cookies?

@KaKi87 KaKi87 transferred this issue from kiwibrowser/android Jul 23, 2021
@KaKi87 KaKi87 added the bug Something isn't working label Jul 23, 2021
@d3ward
Copy link
Collaborator

d3ward commented Aug 1, 2021

Just did a test with samesitetest and seems the "LaxCookie" works .
Consider to reopen the issue if needed, i close it as it looks to be fixed with new Kiwi version and the issue it's very old

@d3ward d3ward closed this as completed Aug 1, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@steffenweber @KaKi87 @7lives83 @d3ward @IT-Gandalf