[Bug]: Inconsistent NextAuth cookie state

[Alarson93]

[Bug]: Inconsistent NextAuth cookie state

[Alarson93]

Ok - did even more digging and have some interesting takeaways.

iOS cookie behavior:
It seems that WKWebView will set cookies that have a max age to WKHTTPCookieStore. A few seconds later, the cookie will also be set to HTTPCookieStorage. Deleting the cookie will remove it from WKHTTPCookieStore, but not from HTTPCookieStorage until the app has been killed and reopened.

This behavior was observed using a sample repo I created. The repo contains two basic projects:

1. An iOS project that contains a WKWebView and cookie watchers.
2. A NextJS project that has create cookie and destroy cookie buttons.

I have only observed this behavior on a physical device, so you must point the web view to your machines local IP address. Cookie events are logged to the Xcode console.

Here are the practical implications:
Let's say I have a project with Capacitor Cookies turned on. The project points to a web portal that authenticates with NextAuth.

Upon logging in, a new auth cookie is added to WKHTTPCookieStore. This new cookie does not trigger CapacitorCookieManager.setCookie for some reason, but that fine because the operating system(?) will add it to HTTPCookieStorage a few seconds later.

I am then brought back to landing screen which creates another cookie for managing my hamburger menu state (i.e. open or closed). This does trigger CapacitorCookieManager.setCookie, so the cookie is added to HTTPCookieStorage and then HTTPCookieStorage is synced to WKHTTPCookieStore. Everything still seems to be fine.

I now log out. The auth cookie is removed from WKHTTPCookieStore, but not immediately from HTTPCookieStorage. I am brought back to the landing page, thus updating the hamburger menu cookie and triggering CapacitorCookieManager.setCookie, so auth cookie HTTPCookieStorage is synced to HTTPCookieStorage to WKHTTPCookieStore. I am stuck in a logged in state.

If I leave the Capacitor Cookies plugin disabled, the syncing never happens so I am never stuck logged in.

Questions:

• It seems like the Capacitor Cookies plugin is meant to keep WKHTTPCookieStore and HTTPCookieStorage in sync in a timely manner. Is that correct?
• Should all cookies be intercepted by CapacitorCookieManager or are there certain types of cookies that cannot be intercepted?