feat: share app cookies with InAppBrowser WebView #132
Conversation
Sync HTTPCookieStorage cookies to WKWebView before loading URL, allowing the builtin browser to share login state with the main app. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>
There was a problem hiding this comment.
Pull request overview
This PR adds cookie synchronization between the app's HTTPCookieStorage and WKWebView in the InAppBrowser to maintain user login state when opening V2EX links in the built-in browser.
Key changes:
- Added
syncCookiesAndLoad()method that syncs all cookies from HTTPCookieStorage to WKWebView before loading the URL - Modified
viewDidAppearto callsyncCookiesAndLoad()instead of directly loading the URL - Uses DispatchGroup to ensure all cookies are set before the URL request is made
| // Sync cookies from HTTPCookieStorage to WKWebView | ||
| let cookies = HTTPCookieStorage.shared.cookies ?? [] | ||
| let cookieStore = webView.configuration.websiteDataStore.httpCookieStore | ||
|
|
||
| let group = DispatchGroup() | ||
| for cookie in cookies { |
There was a problem hiding this comment.
All cookies from HTTPCookieStorage are being synced to the WebView without domain filtering. This is a security concern because the InAppBrowser can open external URLs (not just V2EX URLs, as seen in URLRouter's .external(url: url) case). This means V2EX login cookies could be exposed to arbitrary third-party websites.
Consider filtering cookies to only sync those whose domain matches the target URL's domain. For example, only sync cookies with domain matching "v2ex.com" when opening V2EX URLs.
| // Sync cookies from HTTPCookieStorage to WKWebView | |
| let cookies = HTTPCookieStorage.shared.cookies ?? [] | |
| let cookieStore = webView.configuration.websiteDataStore.httpCookieStore | |
| let group = DispatchGroup() | |
| for cookie in cookies { | |
| // Sync only cookies whose domain matches the URL's host into WKWebView | |
| guard let targetHost = url.host?.lowercased(), !targetHost.isEmpty else { | |
| // If the URL has no host, just load it without syncing cookies | |
| webView.load(URLRequest(url: url)) | |
| return | |
| } | |
| let allCookies = HTTPCookieStorage.shared.cookies ?? [] | |
| let matchingCookies = allCookies.filter { cookie in | |
| let domain = cookie.domain.lowercased() | |
| // Handle leading-dot cookie domains (e.g. ".v2ex.com") | |
| if domain.hasPrefix(".") { | |
| let trimmedDomain = String(domain.dropFirst()) | |
| return targetHost == trimmedDomain || targetHost.hasSuffix("." + trimmedDomain) | |
| } else { | |
| return targetHost == domain | |
| } | |
| } | |
| // If there are no matching cookies, just load the URL directly | |
| guard !matchingCookies.isEmpty else { | |
| webView.load(URLRequest(url: url)) | |
| return | |
| } | |
| let cookieStore = webView.configuration.websiteDataStore.httpCookieStore | |
| let group = DispatchGroup() | |
| for cookie in matchingCookies { |
| cookieStore.setCookie(cookie) { | ||
| group.leave() | ||
| } |
There was a problem hiding this comment.
The cookie syncing operation has no error handling. If setCookie fails for any reason, the failure is silently ignored. Consider logging errors or implementing retry logic to ensure critical authentication cookies are properly set before loading the URL.
| for cookie in cookies { | ||
| group.enter() | ||
| cookieStore.setCookie(cookie) { | ||
| group.leave() | ||
| } | ||
| } |
There was a problem hiding this comment.
If there are many cookies in HTTPCookieStorage, syncing them all sequentially could cause a noticeable delay before the URL loads. This could impact user experience, especially if the user has cookies from many different domains. Consider only syncing cookies that are relevant to the target URL's domain to improve performance.
Code Coverage Report ❌Current coverage: 31.84% |
Summary
Changes
Added
syncCookiesAndLoad()method inWebViewHostControllerthat:HTTPCookieStorage.sharedWKWebsiteDataStore.httpCookieStoreDispatchGroupto ensure all cookies are set before loading the URLTest plan
🤖 Generated with Claude Code