Unable to get HTTPOnly cookies iOS

[fadhlisulaimi]

I have an app that fetches cookies after user login to forum in webview. I am unable to fetch httponly cookies on iOS. It works perfectly in Android. When i look at the source code, document.cookie is injected. Perhaps it is not enough for iOS as it uses WKWebview? It seems Apple stores the cookies in NSHTTPCookieStorage.

Future<Map<String, dynamic>> getCookies()
final cookiesString = await evalJavascript("document.cookie");

[bratan]

Is not possible to retrieve HttpOnly cookies with Javascript:

To help mitigate cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and the HttpOnly flag should be set.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies

The only way to get these cookies is directly from the Android/iOS webviews.

So for Android it would be CookieManager.getInstance().getCookie(url);

And for iOS (11+) WKHTTPCookieStore.getAllCookies

https://developer.apple.com/documentation/webkit/wkhttpcookiestore/2882005-getallcookies

[fadhlisulaimi]

Thanks for the reply.

I agree with you, httponly cookies needs to be protected. I have zero knowledge on iOS development. Do i need to configure anything or set WKHttpCookieStore in the app delegate so that flutter is able to fetch the cookies?

By default, if i just call the method below, it doesnt fetch anything on iOS:

Future<Map<String, dynamic>> getCookies()

[bratan]

Basically you would need to implement the functionality in the native classes for both iOS (FlutterWebviewPlugin.m) and Android (FlutterWebviewPlugin.java) and then call the methods using the platform channels (similar to how evalJavascript method works for example in base.dart)

The method you mentioned Future<Map<String, dynamic>> getCookies() has to be reimplemented as well in order to parse the results as the responses will be different as well.

[fadhlisulaimi]

Thanks! It works!

I use this as reference and invoke my own method and call it:
https://flutter.dev/docs/development/platform-integration/platform-channels

[charafau]

@fadhlisulaimi since you've implemented this, any chance for PR to the plugin? :)

[ftore]

Here is the PR: #773 @charafau can you take a look at this PR. I open to make any changes this PR. I am facing the same issue, and I was able to fix it in local, so I need this PR to be merged as soon as possible.

[charafau]

Hi! Thank you for pr, I will try to do that in reasonable time. Please note that project is in freeze state and if it's possible, please migrate to official web view plugin

[ftore]

@charafau I will do