Why does Android WebView sporadically not sending my session cookie?

Question

I have a server that sends my android app a session cookie to be used for authenticated communication. I am trying to load a WebView with a URL pointing to that same server and I'm trying to pass in the session cookie for authentication. I am observing that it works intermittently but I have no idea why. I use the same session cookie to make other calls on my server and these never fail authentication. I only observe this problem when trying to load a URL in a WebView, and it does not happen every time. Very frustrating.

Below is the code that I'm using to do this. Any help will be greatly appreciated.

String myUrl = "http://example.com/"; 
CookieSyncManager.createInstance(this); 
CookieManager cookieManager = CookieManager.getInstance(); 
Cookie sessionCookie =  getCookie(); 
if(sessionCookie != null){ 
    String cookieString = sessionCookie.getName() +"="+sessionCookie.getValue()+"; domain="+sessionCookie.getDomain(); 
    cookieManager.setCookie(myUrl, cookieString); 
    CookieSyncManager.getInstance().sync(); 
} 

WebView webView = (WebView) findViewById(R.id.webview); 
webView.getSettings().setBuiltInZoomControls(true); 
webView.getSettings().setJavaScriptEnabled(true); 
webView.setWebViewClient(new MyWebViewClient()); 
webView.loadUrl(myUrl);

refer this question http://stackoverflow.com/questions/2566485/webview-and-cookies-on-android — neeraj t, Sep 27 '12 at 14:21

score 59 · Answer 1 · edited Feb 01 '12 at 06:53

59

Thanks justingrammens! That worked for me, I managed to share the cookie within my DefaultHttpClient requests and WebView activity:

//------- Native request activity
private DefaultHttpClient httpClient;
public static Cookie cookie = null;

//After Login
List<Cookie> cookies = httpClient.getCookieStore().getCookies();
for (int i = 0; i < cookies.size(); i++) {
    cookie = cookies.get(i);
}

//------- Web Browser activity
Cookie sessionCookie = myapp.cookie;
CookieSyncManager.createInstance(this);
CookieManager cookieManager = CookieManager.getInstance();
if (sessionCookie != null) {
    cookieManager.removeSessionCookie();
    String cookieString = sessionCookie.getName() + "=" + sessionCookie.getValue() + "; domain=" + sessionCookie.getDomain();
    cookieManager.setCookie(myapp.domain, cookieString);
    CookieSyncManager.getInstance().sync();
}

edited Feb 01 '12 at 06:53

Community

1
1

answered Feb 27 '10 at 23:13

k7k0

1,021
9
14

This worked great for me. I constructed my cookie url thusly: String url = (cookie.isSecure() ? "https" : "http") + "://" + cookie.getDomain() + cookie.getPath(); – Heath Borders Feb 17 '11 at 06:02
thanks for the post...it helped me in implementing the twitter logout for my app...;) – rahul Sep 21 '11 at 11:17
can u tell what to be written in place of myapp.cookie – suraj jain Mar 31 '12 at 09:50
the keyword is: String cookieString = sessionCookie.getName() + "=" + sessionCookie.getValue() + "; domain=" + sessionCookie.getDomain(); cookieManager.setCookie(myapp.domain, cookieString); – Zennichimaro May 10 '12 at 09:30
@surajjain: myapp.cookie is the cookie that you select from the //After login session – Zennichimaro May 10 '12 at 09:31
domain=" + sessionCookie.getDomain(); doesn't work for me, does anyone know why :S ? – rusty009 Aug 01 '12 at 23:49
By the way, recent Android versions do not accept Cookies without expiration (or max-age). Documentation of CookieManager.setCookie says "The cookie being set must not have expired and must not be a session cookie, otherwise it will be ignored." – naktinis Jan 29 '13 at 15:56
Works for me , but point to note is it is `not always the last cookie` from CookieStore is needed to maintain session in WebView (In your logic you are extracting last cookie in FOR loop). – Balaji Feb 06 '14 at 11:41
Using removeSessionCookie method remove my session cookies in my webview, so using this method is a bad idea. – beni Mar 05 '14 at 15:02
I am now using API 21 and android 4.4+. How does it still work with CookieSyncManager? It seems they have deprecated this method. – Soma Hesk Mar 05 '15 at 07:19
This works perfect if I comment cookieManager.removeSessionCookie(); – Nitish Mar 28 '15 at 05:59
1

CookieSyncManager is deprecated now :( – Misha Akopov Apr 04 '16 at 15:03
For my reference can anyone share what is domain exactly inthis. Ex : http://192.168.55:77:8080/serviceName..... – Hareesh Feb 05 '18 at 06:10

Jody Jacobus Geers · Answer 2 · 2016-01-17T07:42:08.653

Thanks Android for ruining my Sunday . . . Heres what fixed my Apps ( after you init your webview )

if ( Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP ) {

  CookieManager cookieManager = CookieManager.getInstance();

  cookieManager.setAcceptThirdPartyCookies( webView, true );

}

I should say the above answers will probably work but in my situation the moment Android went v5+ my android webview javascript 'apps' died.

score 14 · Answer 3 · edited Sep 06 '16 at 14:38

14

Solution:Webview CookieSyncManager

CookieSyncManager cookieSyncManager = CookieSyncManager.createInstance(mWebView.getContext());
CookieManager cookieManager = CookieManager.getInstance();
cookieManager.setAcceptCookie(true);
cookieManager.removeSessionCookie();
cookieManager.setCookie("http://xx.example.com","mid="+MySession.GetSession().sessionId+" ; Domain=.example.com");
cookieSyncManager.sync();

String cookie = cookieManager.getCookie("http://xx.example.com");

Log.d(LOGTAG, "cookie ------>"+cookie);
mWebView.getSettings().setJavaScriptEnabled(true);
mWebView.setWebViewClient(new TuWebViewClient());
mWebView.loadUrl("http://xx.example.com");

edited Sep 06 '16 at 14:38

Kenster

23,465
21
80
106

answered Jun 27 '12 at 20:32

Sanket

499
6
8

what do you get from `cookie` ?, I only get like: `PHPSESSID=ljfakdjfklasdfaj` !, is that enough ? – Francisco Corrales Morales Jun 03 '14 at 14:25
8

What is MySession here? – User3 Nov 09 '15 at 04:14

Jan Muller · Answer 4 · 2013-03-27T11:28:45.190

6

the solution is to give the Android enough time to proccess cookies. You can find more information here: http://code.walletapp.net/post/46414301269/passing-cookie-to-webview

edited Mar 27 '13 at 11:28

answered Apr 18 '11 at 13:09

Jan Muller

402
5
8

link does not have any solution – Shrikant Aug 01 '20 at 12:53

score 3 · Answer 5 · answered Oct 31 '09 at 00:03

3

I would save that session cookie as a preference and forcefully repopulate the cookie manager with it. It sounds that session cookie in not surviving Activity restart

answered Oct 31 '09 at 00:03

Bostone

36,858
39
167
227

I should add that my app makes many other non-WebView on my server calls that never fail authentication. Only when I try to load a URL in a WebView do I notice this problem. "Cookie sessionCookie = getCookie();" is retrieving from the app's DB the session cookie I use for all messages with my server. – nannerpus Oct 31 '09 at 00:19
Well if you are using HttpClient for that it has its own Cookie store, so if you hold to the single instance of the client your cookie will survive, but it may have nothing to do with the one used by your web view – Bostone Oct 31 '09 at 04:57
If I understand you correctly, you're saying that the CookieManager returned by CookieManager.getInstance(); will affect the cookies used by instances of HttpClient, which WebViews do not use. If this is true, do you know how I can explicitly pass cookies into WebViews? Also, looking at the CookieManager docs, perhaps not calling "cookieManager.setAcceptCookie(true)" is causing me problems? Thanks for the help, really appreciate it. – nannerpus Nov 03 '09 at 09:02

score 3 · Answer 6 · edited Oct 16 '13 at 10:16

I've spent the greater half of 3 hours working on a very similar issue. In my case I had a number of calls, that I made to a web service using a DefaulHttpClient and then I wanted to set the session and all other corresponding cookies in my WebView.

I don't know if this will solve your problem, since I don't know what your getCookie() method does, but in my case I actually had to call.

cookieManager.removeSessionCookie();

First to remove the session cookie and then re-add it. I was finding that when I tried to set the JSESSIONID cookie without first removing it, the value I wanted to set it to wasn't being save. Not sure if this will help you particular issue, but thought I'd share what I had found.

why not `CookieManager.getInstance().removeAllCookie ();` ? – Francisco Corrales Morales Jun 03 '14 at 14:24 — Francisco Corrales Morales, Jun 03 '14 at 14:24

score 3 · Answer 7 · answered Oct 24 '18 at 12:52

Couple of comments (at least for APIs >= 21) which I found out from my experience and gave me headaches:

http and https urls are different. Setting a cookie for http://www.example.com is different than setting a cookie for https://www.example.com
A slash in the end of the url can also make a difference. In my case https://www.example.com/ works but https://www.example.com does not work.
CookieManager.getInstance().setCookie is performing an asynchronous operation. So, if you load a url right away after you set it, it is not guaranteed that the cookies will have already been written. To prevent unexpected and unstable behaviours, use the CookieManager#setCookie(String url, String value, ValueCallback callback) (link) and start loading the url after the callback will be called.

I hope my two cents save some time from some people so you won't have to face the same problems like I did.

how different is Setting a cookie for http://www.example.com is different than setting a cookie for https://www.example.com? — softmarshmallow, Dec 09 '19 at 12:55

score 3 · Answer 8 · edited Apr 29 '20 at 14:22

After some time researching I've gathered some pieces that made me get to this solution. Once that CookieSyncManager is deprecated, this may be the best way to set a specific cookie for a webview in Kotlin nowadays, you shouldn't need anything else.

private fun setCookie(){
    val webView = WebView(this) // this = context
    val cookieManager = CookieManager.getInstance()
    cookieManager.acceptCookie()

    val domain = "https://www.yourdomain.com/"

    webView.webViewClient = WebViewClient()
    webView.settings.javaScriptEnabled = true

    cookieManager.setCookie(domain,"$cookieKey=$cookieValue")
    cookieManager.setAcceptThirdPartyCookies(webView, true)

    webView.loadUrl(domain)
}

I would guess that you cannot set on this way http only or https cookies. — rekire, Sep 12 '21 at 10:00

score 1 · Answer 9 · answered Apr 02 '13 at 19:02

I have a different approach from other people here, and it an approach that is guaranteed work without dealing with the CookieSyncManager (where you are at the mercy of semantics like "Note that even sync() happens asynchronously").

Essentially, we browse to the correct domain, then we execute javascript from the page context to set cookies for that domain (the same way the page itself would). Two drawbacks to the method are that may introduce an extra round trip time due to the extra http request you have to make; and if your site does not have the equivalent of a blank page, it may flash whatever URL you load first before taking you to the right place.

import org.apache.commons.lang.StringEscapeUtils;
import org.apache.http.cookie.Cookie;
import android.annotation.SuppressLint;
import android.webkit.CookieManager;
import android.webkit.CookieSyncManager;
import android.webkit.WebView;
import android.webkit.WebViewClient;

public class WebViewFragment {
    private static final String BLANK_PAGE = "/blank.html"

    private CookieSyncManager mSyncManager;
    private CookieManager mCookieManager;

    private String mTargetUrl;
    private boolean mInitializedCookies;
    private List<Cookie> mAllCookies;

    public WebViewFragment(Context ctx) {
        // We are still required to create an instance of Cookie/SyncManager.
        mSyncManager = CookieSyncManager.createInstance(ctx);
        mCookieManager = CookieManager.getInstance();
    }

    @SuppressLint("SetJavaScriptEnabled") public void loadWebView(
                String url, List<Cookie> cookies, String domain) {
        final WebView webView = ...

        webView.setWebViewClient(new CookeWebViewClient());
        webView.getSettings().setJavaScriptEnabled(true);

        mInitializedCookies = false;
        mTargetUrl = url;
        mAllCookies = cookies;
        // This is where the hack starts.
        // Instead of loading the url, we load a blank page.
        webView.loadUrl("http://" + domain + BLANK_PAGE);
    }

    public static String buildCookieString(final Cookie cookie) {
        // You may want to add the secure flag for https:
        // + "; secure"
        // In case you wish to convert session cookies to have an expiration:
        // + "; expires=Thu, 01-Jan-2037 00:00:10 GMT"
        // Note that you cannot set the HttpOnly flag as we are using
        // javascript to set the cookies.
        return cookie.getName() + "=" + cookie.getValue()
                    + "; path=" + cookie.getPath()
                    + "; domain=" + cookie.getDomain()
    };

    public synchronized String generateCookieJavascript() {
        StringBuilder javascriptCode = new StringBuilder();
        javascriptCode.append("javascript:(function(){");
        for (final Cookie cookie : mAllCookies) {
            String cookieString = buildCookieString(cookie);
            javascriptCode.append("document.cookie=\"");
            javascriptCode.append(
                     StringEscapeUtils.escapeJavascriptString(cookieString));
            javascriptCode.append("\";");
        }
        // We use javascript to load the next url because we do not
        // receive an onPageFinished event when this code finishes.
        javascriptCode.append("document.location=\"");
        javascriptCode.append(
                StringEscapeUtils.escapeJavascriptString(mTargetUrl));
        javascriptCode.append("\";})();");
        return javascriptCode.toString();
    }

    private class CookieWebViewClient extends WebViewClient {
        @Override public void onPageFinished(WebView view, String url) {
            super.onPageFinished(view, url);
            if (!mInitializedCookies) {
                mInitializedCookies = true;
                // Run our javascript code now that the temp page is loaded.
                view.loadUrl(generateCookieJavascript());
                return;
            }
        }
    }
}

If you trust the domain the cookies are from, you may be able to get away without apache commons, but you have to understand that this can present a XSS risk if you are not careful.

score 1 · Answer 10 · answered Aug 06 '13 at 10:30

This is a working bit of code.

    private void setCookie(DefaultHttpClient httpClient, String url) {
    List<Cookie> cookies = httpClient.getCookieStore().getCookies();
    if (cookies != null) {
        CookieSyncManager.createInstance(context);
        CookieManager cookieManager = CookieManager.getInstance();
        cookieManager.setAcceptCookie(true);

        for (int i = 0; i < cookies.size(); i++) {
            Cookie cookie = cookies.get(i);
            String cookieString = cookie.getName() + "=" + cookie.getValue();
            cookieManager.setCookie(url, cookieString);
        }
        CookieSyncManager.getInstance().sync();
    }
}

Here the httpclient is the DefaultHttpClient object you used in the HttpGet/HttpPost request. Also one thing to make sure is the cookie name and value, it should be given

String cookieString = cookie.getName() + "=" + cookie.getValue();

setCookie will the set the cookie for the given URL.

Just as a note: you can't store session cookies using CookieManager.setCookie — John Doe, Aug 14 '13 at 16:20

Chani · Answer 11 · 2013-10-21T20:51:02.703

1

I magically solved all my cookie problems with this one line in onCreate:

CookieHandler.setDefault(new CookieManager());

edit: it stopped working today. :( what the crap, android.

edited Oct 21 '13 at 20:51

answered Oct 18 '13 at 19:18

Chani

760
7
11

so, any updates ? why did it stopped working ?, did you solve it ? – Francisco Corrales Morales May 19 '14 at 15:43

Burnok · Answer 12 · 2014-11-07T08:29:43.183

Encountered this too also. Here's what I did.

On my LoginActivity, inside my AsyncTask, I have the following:

CookieStoreHelper.cookieStore = new BasicCookieStore();
BasicHttpContext localContext = new BasicHttpContext();
localContext.setAttribute(ClientContext.COOKIE_STORE, CookieStoreHelper.cookieStore);

HttpResponse postResponse = client.execute(httpPost,localContext);
CookieStoreHelper.sessionCookie = CookieStoreHelper.cookieStore.getCookies();

//WHERE CookieStoreHelper.sessionCookie is another class containing the variable sessionCookie defined as List cookies; and cookieStore define as BasicCookieStore cookieStore;

Then on my Fragment, where my WebView is located i have the following:

//DECLARE LIST OF COOKIE
List<Cookie> sessionCookie;

inside my method or just before you are setting the WebViewClient()

WebSettings settings = webView.getSettings();
settings.setJavaScriptEnabled(true);
webView.setScrollBarStyle(WebView.SCROLLBARS_OUTSIDE_OVERLAY);

sessionCookie = CookieStoreHelper.cookieStore.getCookies();
CookieSyncManager.createInstance(webView.getContext());
CookieSyncManager.getInstance().startSync();
CookieManager cookieManager = CookieManager.getInstance();
CookieManager.getInstance().setAcceptCookie(true);
if (sessionCookie != null) {
   for(Cookie c:  sessionCookie){
      cookieManager.setCookie(CookieStoreHelper.DOMAIN, c.getName() + "=" + c.getValue());
   }
   CookieSyncManager.getInstance().sync();

 }

 webView.setWebViewClient(new WebViewClient() {
    //AND SO ON, YOUR CODE
 }

Quick Tip: Have firebug installed on firefox or use developer console on chrome and test first your webpage, capture the Cookie and check the domain so you can store it somewhere and be sure that you are correctly setting the right domain.

Edit: edited CookieStoreHelper.cookies to CookieStoreHelper.sessionCookie

score 1 · Answer 13 · edited Feb 12 '18 at 08:55

My working code

public View onCreateView(...){
    mWebView = (WebView) view.findViewById(R.id.webview);

    WebSettings webSettings = mWebView.getSettings();
    webSettings.setJavaScriptEnabled(true);

        ...
        ...
        ...

    CookieSyncManager.createInstance(mWebView.getContext());
    CookieManager cookieManager = CookieManager.getInstance();
    cookieManager.setAcceptCookie(true);
    //cookieManager.removeSessionCookie(); // remove
    cookieManager.removeAllCookie(); //remove
    // Recommended "hack" with a delay between the removal and the installation of "Cookies"
    SystemClock.sleep(1000);

    cookieManager.setCookie("https://my.app.site.com/", "cookiename=" + value + "; path=/registration" + "; secure"); // ;
    CookieSyncManager.getInstance().sync();

    mWebView.loadUrl(sp.getString("url", "") + end_url);

    return view;
}

To debug the query, "cookieManager.setCookie (....);" I recommend you to look through the contents of the database webviewCookiesChromium.db (stored in "/data/data/my.app.webview/database") There You can see the correct settings.

Disabling "cookieManager.removeSessionCookie();" and/or "cookieManager.removeAllCookie();"

//cookieManager.removeSessionCookie();
// and/or
//cookieManager.removeAllCookie();"

Compare the set value with those that are set by the browser. Adjust the request for the installation of the cookies before until "flags" browser is not installed will fit with what You decide. I found that a query can be "flags":

// You may want to add the secure flag for https:
+ "; secure"
// In case you wish to convert session cookies to have an expiration:
+ "; expires=Thu, 01-Jan-2037 00:00:10 GMT"
// These flags I found in the database:
+ "; path=/registration"
+ "; domain=my.app.site.com"

i have use above code for store cookie in web view but please let me know about path. what is path here ? — Mehul Tank, Aug 03 '18 at 11:40
@MehulTank The path parameter specifies a document location. The cookie is only sent to the server if path matches the current or a parent document location. — Roland van der Linden, Apr 04 '19 at 09:23

score 0 · Answer 14 · answered Oct 29 '18 at 08:36

I have faced same problem and It will resolve this issue in all android versions

private void setCookie() {
    try {
        CookieSyncManager.createInstance(context);
        CookieManager cookieManager = CookieManager.getInstance();
        cookieManager.setAcceptCookie(true);
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
            cookieManager.setCookie(Constant.BASE_URL, getCookie(), value -> {
                String cookie = cookieManager.getCookie(Constant.BASE_URL);
                CookieManager.getInstance().flush();
                CustomLog.d("cookie", "cookie ------>" + cookie);
                setupWebView();
            });
        } else {
            cookieManager.setCookie(webUrl, getCookie());
            new Handler().postDelayed(this::setupWebView, 700);
            CookieSyncManager.getInstance().sync();
        }

    } catch (Exception e) {
        CustomLog.e(e);
    }
}

CoolMind · Answer 15 · 2020-06-18T09:26:49.403

Note that it may be better use subdomains instead of usual URL. So, set .example.com instead of https://example.com/.

Thanks to Jody Jacobus Geers and others I wrote so:

if (savedInstanceState == null) {
    val cookieManager = CookieManager.getInstance()
    cookieManager.acceptCookie()
    val domain = ".example.com"
    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
        cookieManager.setCookie(domain, "token=$token") {
            view.webView.loadUrl(url)
        }
        cookieManager.setAcceptThirdPartyCookies(view.webView, true)
    } else {
        cookieManager.setCookie(domain, "token=$token")
        view.webView.loadUrl(url)
    }
} else {
    // Check whether we're recreating a previously destroyed instance.
    view.webView.restoreState(savedInstanceState)
}

score -4 · Answer 16 · edited Jan 31 '18 at 10:17

-4

Don't use your raw url

Instead of:

cookieManager.setCookie(myUrl, cookieString);

use it like this:

cookieManager.setCookie("your url host", cookieString);

edited Jan 31 '18 at 10:17

Moradnejad

3,466
2
30
52

answered May 12 '15 at 04:54

Jason

1
1

Why does Android WebView sporadically not sending my session cookie?

16 Answers16

Linked

Related