1035417 - GeckoView Cookie API

Status: REOPENED

(GeckoView :: General, enhancement, P3)

Description

[Heath Borders]

GeckoView should support getting and setting cookies. This should be similar to Android's WebKit CookieManager [1] and CookieSyncManager [2], but with better APIs.

Android only allows setting a cookie with the value of a "Set-Cookie" response header. Similarly, Android only allows getting a cookie with the value of a "Cookie" request header. GeckoView should support returning a cookie object with individual properties for name, value, path, expiration date, version, etc. 

Android docs say setting session cookies isn't allowed (though setting a session cookie does in fact work) [3]. GeckoView should support getting and setting both session and persistent cookies.

Android only supports getting cookies for a particular URL. It doesn't support getting all cookies. GeckoView should support getting all cookies.

This is useful for apps that must integrate with 3rd party SSO providers for SAML integration. Usually, after SAML authentication is successful, an authentication cookie is used for future REST requests. Presently, I use CookieManager#getCookie [4] to get the "Cookie" request header for my authentication cookie, which I must parse to construct an HttpClient cookie I can use to make REST requests.

[1] http://developer.android.com/reference/android/webkit/CookieManager.html
[2] http://developer.android.com/reference/android/webkit/CookieSyncManager.html
[3] https://code.google.com/p/android/issues/detail?id=67475
[4] http://developer.android.com/reference/android/webkit/CookieManager.html#getCookie(java.lang.String)

Comment 1

[Benjamin Smedberg]

Mass change of bugs in the "Embedding: GRE Core" component in preparation for archiving it. I believe that these are no longer relevant; but if they are, they should be reopened and moved into a component relevant to the code in question.

Comment 2

[Myk Melez [:myk] [@mykmelez]]

Reopening and moving to Core::Embedding: APIs, where we'll continue to triage and track GeckoView issues.

Comment 3

[Chris Peterson [:cpeterson]]

WebView has a cookie API (linked in comment 0), though GeckoView's cookie API might look different.

Comment 5

[Alex Nevyantsev]

Hi! Is there any estimates for this feature?
We faced a huge bug with System WebView in Android (https://bugs.chromium.org/p/chromium/issues/detail?id=1003687&can=2&q=Android%20webview). So We decided to use external product instead of WebView. GeckoView is looking really promising.
Unfortunately, we didn't find API for setting cookie to the cookies store. This is a blocking issue for us.

Comment 6

[James Willcox (:snorp) ([e-mail]) (he/him)]

(In reply to Alex Nevyantsev from comment #5)

Hi! Is there any estimates for this feature?
We faced a huge bug with System WebView in Android (https://bugs.chromium.org/p/chromium/issues/detail?id=1003687&can=2&q=Android%20webview). So We decided to use external product instead of WebView. GeckoView is looking really promising.
Unfortunately, we didn't find API for setting cookie to the cookies store. This is a blocking issue for us.

We don't currently have such an API, but you can probably work around it by using a WebExtension. There are some instructions here[0] for using extensions in GeckoView, and you can read about the cookie API for those here[1].

[0] https://mozilla.github.io/geckoview/consumer/docs/web-extensions
[1] https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/cookies

Comment 7

[Chris Peterson [:cpeterson]]

Tasks and enhancements should have severity N/A.