Separate cookie jar per WebView in OS X

Question

I've been trying to achieve the goal of having a unique (not shared) cookie jar per WebView in macOS (cookies management works different for iOS).

After reading a lot of StackOverflow questions and digging through the docs, I found the closest solution to my problem in these articles:

• (how to handle HTTP cookies)
• (how to handle JavaScript document.cookie cookies)

I have set up an example app using them: https://github.com/jjconti/swift-webview-isolated

The basic idea is to implement the necessary methods from the WebResourceLoadDelegate and WebPolicyDelegate protocols and use BSHTTPCookieStorage to store and retrieve cookies. Additionally, my example app allows saving the cookieStorage object so it can be reloaded in future executions.

Unfortunately, the app doesn't work correctly in every website (the author of the articles was targeting one particular web site). For example Gmail and NewRelic, you're immediately logged out after login (or after doing some actions). That makes me suspect a bug in the cookie storage implementation which I haven't been able to find yet.

Could someone tell me if there's something I'm missing?

Answer 1

The problem is there are no JS level cookie isolation. document.cookie still point to the shared cookie jar. To implement a true cookie isolated webview, you must override the cookie property of document.

You may try my implementation: http://cyyuen.github.io/ADCookieIsolatedWebView

It works for the site using document.cookie to get the cookie such as Dropbox.com. However, the setter is not implemented.