[Webkit-unassigned] [Bug 215603] New: couldn't get cookie by js, and the cookie from a request header which including set-cookie

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=215603

            Bug ID: 215603
           Summary: couldn't get cookie by js, and the cookie from a
                    request header which including set-cookie
           Product: WebKit
           Version: Safari 13
          Hardware: All
                OS: macOS 10.15
            Status: NEW
          Severity: Major
          Priority: P2
         Component: New Bugs
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: cacocacoon at gmail.com

Created attachment 406777

  --> https://bugs.webkit.org/attachment.cgi?id=406777&action=review

my test website page

Hi,

I found a cookie bug which behavior is weird, and it happens on safari and chrome on iOS device

current behavior:
1. open safari, and set safari preferences of "safari opens with" to "all windows from last session"
2. create new page like below attachment
3. create a new tab than making a request to server on the page, server responses data which includes set-cookie header like below

`
Set-Cookie: XSRF-TOKEN=767e3675-d094-4af5-a9ab-330529151523; Domain=fleet.dev.aaa.com; Path=/; Secure; SameSite=Strict
`
and obviously I can read XSRF-TOKEN by calling `document.cookie`
4. close whole browser by using shortcut key `command + Q`, and open safari again
5. then call the request again, server also responses data which includes set-cookie header like below
`
Set-Cookie: XSRF-TOKEN=767e3675-d094-4af5-a9ab-330529151523; Domain=fleet.dev.aaa.com; Path=/; Secure; SameSite=Strict
`
6. and you will find that js can't read XSRF-TOKEN by calling `document.cookie`

I found that js can't read XSRF-TOKEN because the page restored from last session, but js can read XSRF-TOKEN because the page opened from a whole new tab

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200818/3875847b/attachment.htm>