Can't clear WebView cookies on iOS + Duplicate cookies

[carlotnx]

I have searched and made sure there are no existing issues for the issue I am filing

• I have searched the existing issues

Description

incorrect webview cookie management

Expected Behavior

1. removeAllHTTPCookies / removeHTTPCookiesForDomain / removeHTTPCookie should delete the cookie
2. only one cookie with the same domain/path/name (RFC 6265 5.3.11 https://datatracker.ietf.org/doc/html/rfc6265#section-5.3)

Actual behavior

1. can't clear the webview cookies in any way
2. when the server send a delete cookie header (Set-Cookie: test=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0) cookie remain active and a new one with the same domain/path/name were stored and sent to the webserver in the following requests

Reproducible sample

app.js

const domain = "carlo.tnx.it";
const page = "https://" + domain + "/set_cookie.php";

const window = Ti.UI.createWindow({
    layout:'vertical'
});

var wv;


const b3 = Ti.UI.createButton({
	top:50,
	height:50,
	title:"open "+page
});
b3.addEventListener('click', () => {
	if(wv) window.remove(wv);//tried to completly remove the instance
	wv = Ti.UI.createWebView({
		height:600
	});
	window.add(wv);
	wv.url  = page
});
window.add(b3);


const b1 = Ti.UI.createButton({
	height:50,
	title:"getHTTPCookiesForDomain("+domain+")"
});
b1.addEventListener('click', () => {
	var debug = '';
	a = Titanium.Network.getHTTPCookiesForDomain(domain);
	for(var i in a) debug += "domain: "+a[i].domain+"\npath: "+a[i].path+"\nname: "+a[i].name+"\nvalue: "+a[i].value+"\n\n";
	alert(debug);
});
window.add(b1);


const b2 = Ti.UI.createButton({
	height:50,
	title:"removeAllHTTPCookies"
});
b2.addEventListener('click', () => Titanium.Network.removeAllHTTPCookies());
window.add(b2);

const b5 = Ti.UI.createButton({
	height:50,
	title:"removeHTTPCookiesForDomain("+domain+")"
});
b5.addEventListener('click', () => Titanium.Network.removeHTTPCookiesForDomain(domain));
window.add(b5);


const b4 = Ti.UI.createButton({
	height:50,
	title:"removeHTTPCookie cicle"
});
b4.addEventListener('click', () => {
	var debug = '';
	a = Titanium.Network.getHTTPCookiesForDomain(domain);
	for(var i in a) Titanium.Network.removeHTTPCookie(a[i].domain, a[i].path, a[i].name);
});
window.add(b4);




window.open();

set_cookie.php

$requestHeaders =  getallheaders();

echo '<div style="font-size:200%">';
echo '<b>HTTP request headers:</b><br />';
foreach($requestHeaders as $key=>$val){
	if($key == "Cookie") echo "<span style='color:red'>";
	echo $key . ': ' . $val;
	if($key == "Cookie") echo "</span>";
	echo "<br />";
}


if(!$_COOKIE['test'] || $_GET['forceResend']){
	setcookie("test", strftime("cookie sent at %H-%M-%S on %Y-%m-%d"), time()+365*86400);
	echo "<br /><br /><b>COOKIE HEADER SENT</b>";
}
else echo "<br /><br /><b>COOKIE HEADER RECEIVED</b>";

if($_GET['delete']){
	setcookie("test", false, time()-365*86400);
	echo "<br /><br /><b>DELETE HEADER SENT</b>";
}


echo "<br /><br /><a href='".$_SERVER['SCRIPT_NAME']."?forceResend=1'>resend</a>";
echo "<br /><br /><a href='".$_SERVER['SCRIPT_NAME']."?delete=1'>send delete header</a>";



$responseHeaders =  headers_list();
if($responseHeaders){
	echo '<br /><br /><b>HTTP response headers:</b><br />';
	foreach($responseHeaders as $val){
		if(strpos($val, "Set-Cookie") === 0) echo "<span style='color:red'>";
		echo $val;
		if(strpos($val, "Set-Cookie") === 0) echo "</span>";
		echo "<br />";
	}
}

echo "</div>";

Steps to reproduce

1. visit the webpage (button 1)
2. check the cookie stored (botton 2)
3. try to delete the cookie (botton 3 or 4 or 5)
4. check again the cookie stored (botton 2), it seems to be deleted
5. visit again the webpage (button 1), original cookie still there (problem 1)
6. try force delete from the server by clicking "send delete header" link in the webpage
7. visit again the webpage (button 1), two identical cookies are sent (problem 2)

Platform

iOS

SDK version you are using

13.0.0.GA

Alloy version you are using

No response

[hbugdoll]

Thanks for reporting!

Without having tested it, I would like to mention the following thoughts:

• The iOS cookie management was added to Titanium SDK in 2014.
• At that time, Titanium SDK was still using UIWebView instead of WKWebView.
• In https://stackoverflow.com/a/33198799 you can read "The problem is that the WKWebView does not write back the cookies immediately."
• Probably it is necessary to replace the currently used NSHTTPCookieStorage with WKHTTPCookieStore
• forget my previous thoughts – I looked in the wrong sources:TiUIWebViewProxy already uses WKHTTPCookieStore, only NetworkModule uses NSHTTPCookieStorage

[hbugdoll]

A small test result:

Testing your reproducible sample code, I don't get two identical cookies in step 7 (problem 2).
Changing the cookie management from Titanium.Network (NetworkModule) to them of the WebView (TiUIWebViewProxy) ...

Titanium.Network.getHTTPCookiesForDomain() → wv.getHTTPCookiesForDomain()
Titanium.Network.removeAllHTTPCookies() → wv.removeAllHTTPCookies()
Titanium.Network.removeHTTPCookiesForDomain() → wv.removeHTTPCookiesForDomain()
Titanium.Network.removeHTTPCookie() → wv.removeHTTPCookie()

... I get two identical cookies in step 7 (problem 2).

[carlotnx]

I can confirm that problem 2 does not occur reliably every time, but it is still very frequent if the cookie deletion header is sent.

[carlotnx]

Any update about this? I can't find another reliable mode to logout my users from private area.

[hbugdoll]

@carlotnx Sorry, I don't have time for further investigations in this case at the moment.

[hbugdoll]

One more quick try:
I log getHTTPCookiesForDomain() for both Titanium.Network and WebView.

There is indeed a sync problem between WKHTTPCookieStore and NSHTTPCookieStorage.

---

A workaround (for problem 1) is to remove the cookies for both:

Titanium.Network.removeAllHTTPCookies();
if (wv) { wv.removeAllHTTPCookies(); }

Result:

1. Visit website (button 1)
2. Visit website again (button 1) → cookie in request headers
3. Remove cookies with workaround (button 3)
4. Visit website again (button 1) → no cookies in request headers

Simulator.Screen.Recording.-.iPhone.16e.-.2025-12-30.at.12.08.52.mov

[carlotnx]

thank you for the workaround

note that WebView.removeAllHTTPCookies(); isn't documented

[hbugdoll]

note that WebView.removeAllHTTPCookies(); isn't documented

Thanks for pointing that out!

It looks as if cookie support on iOS has been in an unfinished state for 6 years:

titanium-sdk/iphone/Classes/TiUIWebViewProxy.m

Lines 664 to 670 in bec5fe9

	// This whole cookie code is not getting used. Reason is -
	// 1. If we use this, parity can not be managed for cookies
	// 2. WKHTTPCookieStore, which manages cookie in WKWebView, is supported in iOS 11+
	// 3. We are using following to implement cookies-
	// https://stackoverflow.com/questions/26573137
	// https://github.com/haifengkao/YWebView
	// TODO: If we can make parity using WKHTTPCookieStore, we should start using WKHTTPCookieStore APIs