Bug 228261
| Summary: | cookies with SameSite information are never sent for “unofficial” or new TLDs in iOS-12.x for non-toplevel requests | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Nathan Phillip Brink (binki) <ohnobinki> |
| Component: | WebCore Misc. | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED CONFIGURATION CHANGED | ||
| Severity: | Normal | CC: | ap |
| Priority: | P2 | ||
| Version: | Other | ||
| Hardware: | iPhone / iPad | ||
| OS: | Other | ||
Nathan Phillip Brink (binki)
In iOS-12.5.3, if I connect to a site with a name such as “blah.not-a-tld” (using a custom local DNS setup) and then issue cookies to Mobile Safari with any SameSite specified (for example, SameSite=Lax), then these cookies are only sent for toplevel requests. They are omitted from XHR.
I suspect that that version of Safari does not have r245299 which changes how areRegistrableDomainsEqual() handles domain names not in the hardcoded TLD list shipped with iOS. I suspect that, prior to r245299, the effective cookie site URI is the empty string. After that change, the effective cookie site will be the entire host (because of the domain.isEmpty() check added in registrableDomainFromHost() by that changeset).
To reproduce:
1. Produce a webserver issuing a header such as Set-Cookie: c=1; Path=/; SameSite=Lax such as with the following command: node -e "require('http').createServer((req, res) => {console.log(req.headers); res.writeHead(200, {'Set-Cookie': 'c=1; Path=/; HttpOnly; SameSite=Lax', 'Cache-Control': 'no-cache', 'Content-Type': 'text/html; charset=utf-8'}).end('<html>');}).listen(3000)"
2. Configure your network and iPod running iOS-12.5.3 (latest for iPod6) such that the host blah.not-a-tld resolves to your server. For example, add an entry the server’s /etc/hosts and run dnsmasq on the server and then set custom DNS servers pointing to your sever in your iPod’s network settings.
3. On the iPod, navigate to http://blah.not-a-tld:3000/.
4. Using Web Inspector from Safari Technology Preview on a Mac OS X machine, run fetch('http://blah.not-a-tld:3000/', { credentials: 'include', }) twice.
Expected results:
The second time the fetch is run, the request should send the cookie. This will be visible to the server and via Web Inspector.
Actual results:
The second time the fetch is run, the cookie is not sent.
If SameSite is removed entirely from the Set-Cookie header, the cookie is sent.
If top-level navigation is performed (e.g., reload the page or renavigate to it in Mobile Safari), the cookie is sent.
The problem is not reproducible in iOS-14.6.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Alexey Proskuryakov
Thank you for the report! Since this is not reproducible on a current version, I'm resolving this as Configuration Changed. There is no way for us to fix an issue back in the past.
Nathan Phillip Brink (binki)
Also affects iOS-12.5.4.