Can not send credentials through CORS on IOS

Viewed 425

I have a poltergeist problem and I come to you after a long time going around with this problem.

I have an Hybrid App with this specs:

-Ionic 3.9.2
-Angular 5.2.11
-Cordova Android 8.1.0 and iOS 5.1.1
-Cordova 8.0.0

My app make request to a SOAP backend which is secured with a secured cookie JSESSIONID (Tomcat server).

I had to enable CORS so that my requests are able to reach the backend, this is the Tomcat CORS filter:

<filter>
  <filter-name>CorsFilter</filter-name>
  <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
    <init-param>
        <param-name>cors.allowed.origins</param-name>
        <param-value>ionic://localhost,http://localhost</param-value>
    </init-param>
    <init-param>
        <param-name>cors.allowed.methods</param-name>
        <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
    </init-param>
    <init-param>
        <param-name>cors.allowed.headers</param-name>
        <param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,SOAPAction,Cache-Control</param-value>
    </init-param>
    <init-param>
        <param-name>cors.exposed.headers</param-name>
        <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
    </init-param>
    <init-param>
        <param-name>cors.support.credentials</param-name>
        <param-value>true</param-value>
    </init-param>
    <init-param>
        <param-name>cors.preflight.maxage</param-name>
        <param-value>10</param-value>
    </init-param>
</filter>
<filter-mapping>
  <filter-name>CorsFilter</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

When I do login against the backend the server SETS a cookie (JSESSION) which is used to send in subsequent request to backend to authenticate in secured WS. This is the code to make request with httpclient angular(Same for subsequent request)

 this.http.post(wsurl, xml, {
        withCredentials: true,
        responseType: 'text',
        headers: headers,
        observe: 'response'
      })
        .toPromise()
        .then(response => {})
        .catch(err =>{})

My problem is that the backend, after enable CORS, not authenticate my subsequent request on iOS/safari (Android, chrome works fine)

But this is the poltergeist:

Same build of app deployed on Iphone 6 iOS v12.4.5 works fine. On a iPhone X with iOS v 14 and simulators(any version) not work.

Backend returns this error:

<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <soapenv:Body>
        <soapenv:Fault>
            <faultcode>soapenv:Server.generalException</faultcode>
            <faultstring>User has not a valid M4Session</faultstring>
            <detail>
                <ns1:exceptionName xmlns:ns1="http://xml.apache.org/axis/">com.meta4.soapservices.exception.M4SoapException</ns1:exceptionName>
                <ns2:hostname xmlns:ns2="http://xml.apache.org/axis/">cd102015</ns2:hostname>
            </detail>
        </soapenv:Fault>
    </soapenv:Body>
</soapenv:Envelope>

How can I fix this?

0 Answers
Related