Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow a cookie without a domain to be set on Android #1295

Merged
merged 1 commit into from
Oct 13, 2022

Conversation

bagedevimo
Copy link
Contributor

The other CookieManager implementations in Flutter allow for no domain,
as the Android CookieManager implementation. By providing a default
domain, applications cannot opt-out of the default
CookieManager.setCookie behaviour (which prepends a "period" to the
domain), which is treated as a different domain by Webkit on Android.
This leads to multiple cookies for the same URL if the server serves a
cookie without a domain, or with a domain that does not contain a
leading period.

Note, iOS's setCookie doesn't take a url parameter (at least in the way
it's called from flutter_inappwebview) and instead this is passed an
attribute on the HTTPCookie object itself (originURL). When constructing
a HTTPCookie you must supply either originURL OR domain. Both a
permitted, but at least one must be present. [1]

By making domain optional, without a default, on both platforms,
consumers can now set cookies that don't use the domain attribute but
still allows for setting a domain when required.

[1] https://developer.apple.com/documentation/foundation/httpcookie/1392975-init

Testing and Review Notes

Existing usages shouldn't be affected, unless they were relying on this default behavior which kinda wasn't documented so I dunno how much we care about that contract?

Screenshots or Videos

N/A

To Do

  • double check the original issue to confirm it is fully satisfied
  • add testing notes and screenshots in PR description to help guide reviewers
  • request the "UX" team perform a design review (if/when applicable)

The other CookieManager implementations in Flutter allow for no domain,
as the Android CookieManager implementation. By providing a default
domain, applications cannot opt-out of the default
CookieManager.setCookie behaviour (which prepends a "period" to the
domain), which is treated as a different domain by Webkit on Android.
This leads to multiple cookies for the same URL if the server serves a
cookie without a domain, or with a domain that does not contain a
leading period.

Note, iOS's setCookie doesn't take a url parameter (at least in the way
it's called from flutter_inappwebview) and instead this is passed an
attribute on the HTTPCookie object itself (originURL). When constructing
a HTTPCookie you must supply either originURL OR domain. Both a
permitted, but at least one must be present. [1]

By making domain optional, without a default, on both platforms,
consumers can now set cookies that don't use the domain attribute but
still allows for setting a domain when required.

[1] https://developer.apple.com/documentation/foundation/httpcookie/1392975-init
@pichillilorenzo pichillilorenzo merged commit 069594a into pichillilorenzo:master Oct 13, 2022
@pichillilorenzo
Copy link
Owner

Thanks! @all-contributors please add @bagedevimo for code

@allcontributors
Copy link
Contributor

@pichillilorenzo

I've put up a pull request to add @bagedevimo! 🎉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants