| Summary: | Safari (still) doesn't send Lax cookies after a cross-site redirection | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Flávio Juvenal (fjsj) <flavio> | ||||
| Component: | Page Loading | Assignee: | Nobody <webkit-unassigned> | ||||
| Status: | RESOLVED DUPLICATE | ||||||
| Severity: | Normal | CC: | adam, beidson, cdumez, dbates, paul.savoie, wilander | ||||
| Priority: | P2 | ||||||
| Version: | Safari 12 | ||||||
| Hardware: | iPhone / iPad | ||||||
| OS: | iOS 12 | ||||||
| Attachments: |
|
||||||
|
Description
Flávio Juvenal (fjsj)
2019-03-28 15:10:31 PDT
- FIXED on Safari Technology Preview Release 77 (Safari 12.2, WebKit 14608.1.7.3) - as stated before - FIXED on Safari Technology Preview Release 78 (Safari 12.2, WebKit 14608.1.9.1) So this has already been fixed? If so, why the bug report? (In reply to Chris Dumez from comment #1) > - FIXED on Safari Technology Preview Release 77 (Safari 12.2, WebKit > 14608.1.7.3) - as stated before > - FIXED on Safari Technology Preview Release 78 (Safari 12.2, WebKit > 14608.1.9.1) > > So this has already been fixed? If so, why the bug report? Personally, I get: request.session.session_key: jzk0evlci0c5lq3v174ti02g7zlp6kxj On first link. and request.session.session_key: jzk0evlci0c5lq3v174ti02g7zlp6kxj On second link. Seems fine, no? Chris Dumez, I've described this issue at #188165, Alexey Proskuryakov asked me to "file a new bug, with complete steps to reproduce" and a live site. That's what I did here. Alexey also believed issue should be fixed in iOS 12.2 and macOS 10.14.4, but it isn't (or at least isn't in non-beta version). Also, check John Wilander comment 45: https://bugs.webkit.org/show_bug.cgi?id=188165#c45 Are you testing on Safari 12.1 (not Technology Preview)? (In reply to Flávio Juvenal (fjsj) from comment #3) > Chris Dumez, I've described this issue at #188165, Alexey Proskuryakov asked > me to "file a new bug, with complete steps to reproduce" and a live site. > That's what I did here. Alexey also believed issue should be fixed in iOS > 12.2 and macOS 10.14.4, but it isn't (or at least isn't in non-beta > version). Also, check John Wilander comment 45: > https://bugs.webkit.org/show_bug.cgi?id=188165#c45 > > Are you testing on Safari 12.1 (not Technology Preview)? The odd thing is that the fix was apparently in CFNetwork, not WebKit/Safari. Therefore, I would not expect different behavior with Safari Technology Preview and System Safari from macOS 10.14.4. (In reply to Chris Dumez from comment #4) > (In reply to Flávio Juvenal (fjsj) from comment #3) > > Chris Dumez, I've described this issue at #188165, Alexey Proskuryakov asked > > me to "file a new bug, with complete steps to reproduce" and a live site. > > That's what I did here. Alexey also believed issue should be fixed in iOS > > 12.2 and macOS 10.14.4, but it isn't (or at least isn't in non-beta > > version). Also, check John Wilander comment 45: > > https://bugs.webkit.org/show_bug.cgi?id=188165#c45 > > > > Are you testing on Safari 12.1 (not Technology Preview)? > > The odd thing is that the fix was apparently in CFNetwork, not > WebKit/Safari. Therefore, I would not expect different behavior with Safari > Technology Preview and System Safari from macOS 10.14.4. Interesting, I was testing on a more recent OS build as it was working. I have confirmed that it indeed does not work as expected on macOS 10.14.4 with System Safari. (In reply to Chris Dumez from comment #5) > (In reply to Chris Dumez from comment #4) > > (In reply to Flávio Juvenal (fjsj) from comment #3) > > > Chris Dumez, I've described this issue at #188165, Alexey Proskuryakov asked > > > me to "file a new bug, with complete steps to reproduce" and a live site. > > > That's what I did here. Alexey also believed issue should be fixed in iOS > > > 12.2 and macOS 10.14.4, but it isn't (or at least isn't in non-beta > > > version). Also, check John Wilander comment 45: > > > https://bugs.webkit.org/show_bug.cgi?id=188165#c45 > > > > > > Are you testing on Safari 12.1 (not Technology Preview)? > > > > The odd thing is that the fix was apparently in CFNetwork, not > > WebKit/Safari. Therefore, I would not expect different behavior with Safari > > Technology Preview and System Safari from macOS 10.14.4. > > Interesting, I was testing on a more recent OS build as it was working. I > have confirmed that it indeed does not work as expected on macOS 10.14.4 > with System Safari. And it works with Trunk WebKit on macOS 10.14.4. So there is definitely a fix in WebKit that's needed. Dan Bates was the WebKit engineer working on this. (In reply to Chris Dumez from comment #6) > (In reply to Chris Dumez from comment #5) > > (In reply to Chris Dumez from comment #4) > > > (In reply to Flávio Juvenal (fjsj) from comment #3) > > > > Chris Dumez, I've described this issue at #188165, Alexey Proskuryakov asked > > > > me to "file a new bug, with complete steps to reproduce" and a live site. > > > > That's what I did here. Alexey also believed issue should be fixed in iOS > > > > 12.2 and macOS 10.14.4, but it isn't (or at least isn't in non-beta > > > > version). Also, check John Wilander comment 45: > > > > https://bugs.webkit.org/show_bug.cgi?id=188165#c45 > > > > > > > > Are you testing on Safari 12.1 (not Technology Preview)? > > > > > > The odd thing is that the fix was apparently in CFNetwork, not > > > WebKit/Safari. Therefore, I would not expect different behavior with Safari > > > Technology Preview and System Safari from macOS 10.14.4. > > > > Interesting, I was testing on a more recent OS build as it was working. I > > have confirmed that it indeed does not work as expected on macOS 10.14.4 > > with System Safari. > > And it works with Trunk WebKit on macOS 10.14.4. So there is definitely a > fix in WebKit that's needed. I am working on bisecting which Webkit change fixed this. (In reply to Chris Dumez from comment #8) > (In reply to Chris Dumez from comment #6) > > (In reply to Chris Dumez from comment #5) > > > (In reply to Chris Dumez from comment #4) > > > > (In reply to Flávio Juvenal (fjsj) from comment #3) > > > > > Chris Dumez, I've described this issue at #188165, Alexey Proskuryakov asked > > > > > me to "file a new bug, with complete steps to reproduce" and a live site. > > > > > That's what I did here. Alexey also believed issue should be fixed in iOS > > > > > 12.2 and macOS 10.14.4, but it isn't (or at least isn't in non-beta > > > > > version). Also, check John Wilander comment 45: > > > > > https://bugs.webkit.org/show_bug.cgi?id=188165#c45 > > > > > > > > > > Are you testing on Safari 12.1 (not Technology Preview)? > > > > > > > > The odd thing is that the fix was apparently in CFNetwork, not > > > > WebKit/Safari. Therefore, I would not expect different behavior with Safari > > > > Technology Preview and System Safari from macOS 10.14.4. > > > > > > Interesting, I was testing on a more recent OS build as it was working. I > > > have confirmed that it indeed does not work as expected on macOS 10.14.4 > > > with System Safari. > > > > And it works with Trunk WebKit on macOS 10.14.4. So there is definitely a > > fix in WebKit that's needed. > > I am working on bisecting which Webkit change fixed this. Fails: r241775 Works: r241964 I am having issues with the builds in between :/ (In reply to Chris Dumez from comment #9) > (In reply to Chris Dumez from comment #8) > > (In reply to Chris Dumez from comment #6) > > > (In reply to Chris Dumez from comment #5) > > > > (In reply to Chris Dumez from comment #4) > > > > > (In reply to Flávio Juvenal (fjsj) from comment #3) > > > > > > Chris Dumez, I've described this issue at #188165, Alexey Proskuryakov asked > > > > > > me to "file a new bug, with complete steps to reproduce" and a live site. > > > > > > That's what I did here. Alexey also believed issue should be fixed in iOS > > > > > > 12.2 and macOS 10.14.4, but it isn't (or at least isn't in non-beta > > > > > > version). Also, check John Wilander comment 45: > > > > > > https://bugs.webkit.org/show_bug.cgi?id=188165#c45 > > > > > > > > > > > > Are you testing on Safari 12.1 (not Technology Preview)? > > > > > > > > > > The odd thing is that the fix was apparently in CFNetwork, not > > > > > WebKit/Safari. Therefore, I would not expect different behavior with Safari > > > > > Technology Preview and System Safari from macOS 10.14.4. > > > > > > > > Interesting, I was testing on a more recent OS build as it was working. I > > > > have confirmed that it indeed does not work as expected on macOS 10.14.4 > > > > with System Safari. > > > > > > And it works with Trunk WebKit on macOS 10.14.4. So there is definitely a > > > fix in WebKit that's needed. > > > > I am working on bisecting which Webkit change fixed this. > > Fails: r241775 > Works: r241964 > > I am having issues with the builds in between :/ Looking at the commits, it is very likely fixed by: https://trac.webkit.org/changeset/241918/webkit *** This bug has been marked as a duplicate of bug 194906 *** Chris, thanks for the quick response to this issue. Have you checked if the other "Steps to reproduce (other issue?)" I listed above is also fixed by Changeset 241918? It affects only iOS, AFAIK. (In reply to Flávio Juvenal (fjsj) from comment #12) > Chris, thanks for the quick response to this issue. Have you checked if the > other "Steps to reproduce (other issue?)" I listed above is also fixed by > Changeset 241918? It affects only iOS, AFAIK. Oh, I haven't. I'll check later today and comment again. (In reply to Chris Dumez from comment #13) > (In reply to Flávio Juvenal (fjsj) from comment #12) > > Chris, thanks for the quick response to this issue. Have you checked if the > > other "Steps to reproduce (other issue?)" I listed above is also fixed by > > Changeset 241918? It affects only iOS, AFAIK. > > Oh, I haven't. I'll check later today and comment again. I have just tried your steps for "other issue" and they do not reproduce an issue for me, even on macOS 10.14.4. I assume this other issue could have been Bug 188165 which got fixed in macOS 10.14.4. Can you really reproduce on macOS 10.14.4? No, they're reproducible in iOS 12.2. Does iOS 12.2 already contains the fix for Bug 188165? (In reply to Flávio Juvenal (fjsj) from comment #15) > No, they're reproducible in iOS 12.2. Does iOS 12.2 already contains the fix > for Bug 188165? Oh, I have not tried iOS 12.2. And yes, the CFNetwork fix for Bug 188165 is supposed to have shipped in iOS 12.2, it is definitely surprising it would reproduce there. I'll try and do some iOS testing today. (In reply to Chris Dumez from comment #16) > (In reply to Flávio Juvenal (fjsj) from comment #15) > > No, they're reproducible in iOS 12.2. Does iOS 12.2 already contains the fix > > for Bug 188165? > > Oh, I have not tried iOS 12.2. And yes, the CFNetwork fix for Bug 188165 is > supposed to have shipped in iOS 12.2, it is definitely surprising it would > reproduce there. > I'll try and do some iOS testing today. Does not reproduce for me on iOS 12.2 either. Created attachment 366289 [details] iOS 12.2 in-app Safari Lax cookies issue Chris, I've attached a video with the reproduction for the iOS-only problem. It only happens on GMail with in-app Safari browser. I know that cookies aren't shared between Safari and GMail's webview, but the issue is that the webview doesn't seem to be able to set any Lax cookies. The video above tests the site https://safari-samesite-issue.herokuapp.com/target/ which uses Lax cookies. Test with that link, it won't work. Afterwards, test with https://safari-issue-samesite-no-lax.herokuapp.com/target/, which doesn't use Lax cookies. It'll work. (In reply to Flávio Juvenal (fjsj) from comment #18) > Created attachment 366289 [details] > iOS 12.2 in-app Safari Lax cookies issue > > Chris, I've attached a video with the reproduction for the iOS-only problem. > It only happens on GMail with in-app Safari browser. > > I know that cookies aren't shared between Safari and GMail's webview, but > the issue is that the webview doesn't seem to be able to set any Lax cookies. > > The video above tests the site > https://safari-samesite-issue.herokuapp.com/target/ > which uses Lax cookies. Test with that link, it won't work. Afterwards, test > with https://safari-issue-samesite-no-lax.herokuapp.com/target/, which > doesn't use Lax cookies. It'll work. I need to try with the Gmail app, I had tried with Gmail.com in MobileSafari earlier. (In reply to Chris Dumez from comment #19) > (In reply to Flávio Juvenal (fjsj) from comment #18) > > Created attachment 366289 [details] > > iOS 12.2 in-app Safari Lax cookies issue > > > > Chris, I've attached a video with the reproduction for the iOS-only problem. > > It only happens on GMail with in-app Safari browser. > > > > I know that cookies aren't shared between Safari and GMail's webview, but > > the issue is that the webview doesn't seem to be able to set any Lax cookies. > > > > The video above tests the site > > https://safari-samesite-issue.herokuapp.com/target/ > > which uses Lax cookies. Test with that link, it won't work. Afterwards, test > > with https://safari-issue-samesite-no-lax.herokuapp.com/target/, which > > doesn't use Lax cookies. It'll work. > > I need to try with the Gmail app, I had tried with Gmail.com in MobileSafari > earlier. Ok, I was able to reproduce the issue on iOS 12.2 using the Gmail app. I have confirmed that r241900 fails and r241920 works. It is therefore extremely likely that this was fixed by https://trac.webkit.org/changeset/241918/webkit and that the iOS issue you're seeing is a dupe of bug 194906 as well. Good to know, thanks. Does that mean the next minor version update should fix this or that's hard to say? (In reply to Flávio Juvenal (fjsj) from comment #21) > Good to know, thanks. Does that mean the next minor version update should > fix this or that's hard to say? Sorry, I cannot comment on when a particular fix will ship to customers. This does seems like a bad bug though and I hope we can ship to customers sooner rather than later. |