You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@cordova.apache.org by GitBox <gi...@apache.org> on 2022/03/28 16:33:19 UTC
[GitHub] [cordova-ios] abhinavms opened a new issue #1228: Cookies are blocked in iframe even after disabling ITP
abhinavms opened a new issue #1228:
URL: https://github.com/apache/cordova-ios/issues/1228
# Bug Report
## Problem
Even after allowing cross-site tracking in the app setting to disable ITP, the 3rd party cookies are still not being set in iframe. The Storage Access API denies the request to access storage. This causes login to fail in the iframe.
### What is expected to happen?
Cookies should be stored and sent in every request
### What does actually happen?
Cookies are not being stored
## Information
<!-- Include all relevant information that might help understand and reproduce the problem -->
I have created a sample application to illustrate the problem. Link - https://github.com/abhinavms/cordova-3rdparty-cookie
The webview loads URL [abhinavms.github.io/cookieTest](https://abhinavms.github.io/cookieTest/). It has an iframe that loads [cookie-set-test.herokuapp](https://cookie-set-test.herokuapp.com/) ([Source code](https://github.com/abhinavms/cookie)). [cookie-set-test.herokuapp](https://cookie-set-test.herokuapp.com/) sends a request to set a cookie and verify if the cookie was set. It also displays if the Storage Access API has granted access.
With the latest Xcode version, it is observed that the cookie is never being set in the iframe unless already a first-party cookie was available. This issue was also reproducible in iOS 12.4, which doesn't have ITP
Observations
1. The iframe does not have the Storage Access API, therefore cookies are not being stored
2. document.requestStorageAccess() is denying the request to access storage to save cookies
3. If the 3rd party domain already has a 1st party cookie, then storage access is given and it can load in the iframe
### Environment, Platform, Device
<!-- In what environment, on what platform or on which device are you experiencing the issue? -->
Xcode 13.3
iOS 15.3, 12.4
## Checklist
<!-- Please check the boxes by putting an x in the [ ] like so: [x] -->
- [x] I searched for existing GitHub issues
- [x] I updated all Cordova tooling to most recent version
- [x] I included all the necessary information above
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
[GitHub] [cordova-ios] abhinavms edited a comment on issue #1228: Cookies are blocked in iframe even after disabling ITP
Posted by GitBox <gi...@apache.org>.
abhinavms edited a comment on issue #1228:
URL: https://github.com/apache/cordova-ios/issues/1228#issuecomment-1081411759
[breautek](https://github.com/breautek)
If my understanding is correct when I enable "Allow cross-site tracking" in the settings, then shouldn't ITP be disabled and the access is given?
I've added ```sandbox="allow-storage-access-by-user-activation allow-scripts allow-same-origin"```
However, access was still not granted.
The iframe on the sample app I provided is a direct child of the webpage.
Yeah, I think you are right. It could not be related to ITP and be related to other cookie bugs on the link you provided. After doing some more tests I will reply back. Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
[GitHub] [cordova-ios] abhinavms commented on issue #1228: Cookies are blocked in iframe even after disabling ITP
Posted by GitBox <gi...@apache.org>.
abhinavms commented on issue #1228:
URL: https://github.com/apache/cordova-ios/issues/1228#issuecomment-1081366833
In mobile and desktop Safari, disabling the "Prevent Cross-Site Tracking" option causes the site to work as expected. In chrome also no issue seems to be there. The only issue is on the mobile app with `NSCrossWebsiteTrackingUsageDescription` option.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
[GitHub] [cordova-ios] abhinavms edited a comment on issue #1228: Cookies are blocked in iframe even after disabling ITP
Posted by GitBox <gi...@apache.org>.
abhinavms edited a comment on issue #1228:
URL: https://github.com/apache/cordova-ios/issues/1228#issuecomment-1081411759
[breautek](https://github.com/breautek)
If my understanding is correct when I enable "Allow cross-site tracking" in the settings, then shouldn't ITP be disabled and the access is given?
I've added ```sandbox="allow-storage-access-by-user-activation allow-scripts allow-same-origin"```
However, access was still not granted.
The iframe on the sample app I provided is a direct child of the webpage.
Yeah, I think you are right. It could be unrelated to ITP and be related to other cookie bugs on the link you provided. After doing some more tests I will reply back. Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
[GitHub] [cordova-ios] abhinavms commented on issue #1228: Cookies are blocked in iframe even after disabling ITP
Posted by GitBox <gi...@apache.org>.
abhinavms commented on issue #1228:
URL: https://github.com/apache/cordova-ios/issues/1228#issuecomment-1081411759
[breautek](https://github.com/breautek)
If my understanding is correct when I enable "Allow cross-site tracking" in the settings, then shouldn't ITP be disabled and the access is given?
I've added ```sandbox="allow-storage-access-by-user-activation allow-scripts allow-same-origin"```
However, access was still not granted.
The iframe on the sample app I provided is a direct child of the webpage.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
[GitHub] [cordova-ios] abhinavms edited a comment on issue #1228: Cookies are blocked in iframe even after disabling ITP
Posted by GitBox <gi...@apache.org>.
abhinavms edited a comment on issue #1228:
URL: https://github.com/apache/cordova-ios/issues/1228#issuecomment-1081411759
[breautek](https://github.com/breautek)
If my understanding is correct when I enable "Allow cross-site tracking" in the settings, then shouldn't ITP be disabled and the access is given?
I've added ```sandbox="allow-storage-access-by-user-activation allow-scripts allow-same-origin"```
However, access was still not granted.
The iframe on the sample app I provided is a direct child of the webpage.
Yeah, you are right. I think it is unrelated to ITP and be related to other cookie bugs on the link you provided. After doing some more tests I will reply back. Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
[GitHub] [cordova-ios] breautek edited a comment on issue #1228: Cookies are blocked in iframe even after disabling ITP
Posted by GitBox <gi...@apache.org>.
breautek edited a comment on issue #1228:
URL: https://github.com/apache/cordova-ios/issues/1228#issuecomment-1081397548
Iframes don't have access to the storage api by default, which is required to handle ITP.
Iframes that is a direct child of the top level frame have an attribute to enable the storage access api. Direct child iframes can have
`sandbox="allow-storage-access-by-user-activation"` to enable storage access.
From what I read, iframes in which is nested do not have storage access, even with the sandbox attribute.
Note that if either the top frame or the iframe document navigates, storage access is revoked. Any storage grants only persists for the lifetime of the document.
Disclaimer: don't have the means to confirm or test any of this. Just summarizing [webkits blog](https://webkit.org/blog/8124/introducing-storage-access-api/)
Also there are some cookie bugs that is unrelated to ITP in WKWebView, which was reported to Apple via https://bugs.webkit.org/show_bug.cgi?id=213510 which I think effects ios <= 13. Your reproduction on ios 12.4, while show similar symptoms is likely related to cookie syncing issues on wkwebview. I believe these are fixed in later ios versions (but I don't work cookies so not sure on the exact details here on this.)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
[GitHub] [cordova-ios] breautek commented on issue #1228: Cookies are blocked in iframe even after disabling ITP
Posted by GitBox <gi...@apache.org>.
breautek commented on issue #1228:
URL: https://github.com/apache/cordova-ios/issues/1228#issuecomment-1081397548
Iframes don't have access to the storage api by default, which is required to handle ITP.
Iframes that is a direct child of the top level frame have an attribute to enable the storage access api. Direct child iframes can have
`sandbox="allow-storage-access-by-user-activation"` to enable storage access.
From what I read, iframes in which is nested do not have storage access, even with the sandbox attribute.
Note that if either the top frame or the iframe document navigates, storage access is revoked. Any storage grants only persists for the lifetime of the document.
Disclaimer: don't have the means to confirm or test any of this. Just summarizing [webkits blog](https://webkit.org/blog/8124/introducing-storage-access-api/)
Also there are some cookie bugs that is unrelated to ITP in WKWebView, which was reported to Apple via https://bugs.webkit.org/show_bug.cgi?id=213510 which I think effects ios <= 13. Your reproduction on ios 12.4, while show similar symptoms is likely related to cookie syncing issues on wkwebview. I believe these are fixed in later ios versions (but I don't work cookies so not sure on the exact details here on this.)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org