Cookies not shared on iOS between SFAuthenticationSession and Safari instances

Originator:craig.lane
Number:rdar://34816736 Date Originated:October 4 2017
Status:Closed Resolved:July 25 2018
Product:iOS Safari Services Product Version:11
Classification:Bug Reproducible:Yes
 
Cookies are not being reliably shared between SFAuthenticationSession instances on different applications, and/or with Safari on iOS 11 devices.  Changes made to cookies inside one instance (create/delete) are not reflected inside other applications.  

This breaks Single Sign-on (SSO) and Sign Log-out (SLO) for apps using a common web session for primary authentication in OAuth flows.

However, it appears to be working on iOS 11 (15A372) device simulators.

Expected Results:
The cookie should be shared between the two applications as conveyed through the cookie name label, or by viewing the /get-cookie/user path in Safari.

Actual Results:
Applications/Safari will display unique cookie token values.  Deleting cookie from one application will not delete token from other applications scope. 

Version/Build:
Simulator:
iOS 11.0 (15A372) - Working most of the time

Devices:
iPhone 6s - iOS 11.0.2 (15A421) - Not working
iPhone 7 - iOS 11.1 (15B5066f) - Not working


NOTE: Still broken in iOS11, but fixed in iOS12

Comments


Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!