How can an iOS native app like Vimeo set cookies to mobile Safari?

Question

I find Vimeo iOS native app can set cookies to mobile Safari. How does it do?

Repo steps:

1, Install Vimeo iOS native app on an iOS device.

2, Open this Vimeo iOS native app and then sign in with your Vimeo account.

3, Open mobile Safari and then open web page "https://vimeo.com/". You find you are not signed in Vimeo.

4, Open Vimeo iOS native app and then click on the "Help (question mark)" icon in the left navigation bar. You will see that Vimeo's web page help center is opened via UIWebView. And then you can close this help center.

5, Open mobile Safari and then open web page "https://vimeo.com/". You find you are signed in Vimeo.

Thank you.

Answer 1

This obviously wouldn't have applied at the time of the OP's question, but more recently cookies were shared between Safari and SFSafariViewController instances in iOS 9 and 10. Vimeo could have set a cookie via an invisible SFSafariViewController to achieve this result. However, this has changed in iOS 11. Going forward, every app (including Safari itself) will have a completely sandboxed data store. Official announcement here (at the 17:28 mark).

In iOS 11, behavior like this will no longer be possible (in fact, preventing it was the featured example in Apple's announcement about this change).

If you need a way to pass a guaranteed user match through from Safari to your app, you'll need to use an existing network of device matches, such as Branch.io (full disclosure: I'm on the Branch team). You can read about the techniques Branch uses instead of cookie passthrough here.