iOS sporadically sends old cookies

user_17174 0
Viewed 1072

I have an application that rotates an auth token cookie values regularly.

Each time the server rotates the token, it will not mark it as "good" until it sees the client has the token (cause the client includes it in the request headers for a resource).

I have a very specific situation ONLY on iOS (10.3) where sporadically it will send a very old cookie when network conditions change (eg: get off the subway). When this condition hits it "forgets" about the most recent cookie value and "starts living in the past" and sends and old value.

log

** Security note: IP addresses are publicly allocated t-mobile in NYC and token has long been deleted from our DB

  • Is this a known issue?
  • Are there any workarounds for cookie handling that is more robust on iOS? localstorage is not ideal cause these cookies are http only.

To clarify ... this is the flow:

  1. Client (iOS Safari) has a cookie called _t with the value old
  2. Client (iOS Safari) makes a request to the server
  3. We issue Set-Cookie and set _t cookie to a new value new (http only, secure cookie)
  4. Client makes another request with the new cookie value new. We flag that the cookie value is good and client has it.
  5. Time passes
  6. Client makes a request with the _t cookie with the value old
sfsafariviewcontroller mobile-safari authentication cookies ios
5 Answers

My experience

I also use authentication via IDs that change with each request and are stored in cookies. I can confirm this behavior and it is still present in iOS 11 (and iOS 11.1 beta 3). In my log files, I can see that sometimes old cookies are randomly stored in Safari. This happens in a standalone webapp when it is closed and reopened.

My Fallback method

I built a fallback method over localStorage. A request with an old cookie will normally mark all data in my database as invalid. If the user agent points to a device with iOS, I do not mark the data as invalid and give the client a second attempt to authenticate itself.

On the client side I check the localStorage and create new cookies with this data. Subsequently, a new authentication takes place. The localStorage is rewritten like the cookies with each request. If authentication fails again, I mark the data as invalid.

user_87631610
user_1453490
Related