diff options
| author | Peter Stone <thepeterstone@gmail.com> | 2026-08-22 01:08:42 +0000 |
|---|---|---|
| committer | Peter Stone <thepeterstone@gmail.com> | 2026-08-22 01:08:42 +0000 |
| commit | a5f728648dda46e84959a4568a3f04d5cc7bb11f (patch) | |
| tree | 90f1681bceb486a5df326ffd0046db6113e26d9b /app | |
| parent | 3b8af4faeca81cb598ad3d366d64d8148534d150 (diff) | |
BrowserScreen: don't accept third-party cookies
This screen exists so a site's own first-party login session cookie
survives into the reader's later extraction requests -- that's all
the login-persistence feature needs. Third-party cookies are for
cross-site trackers embedded in whatever page is loaded here, which
this feature has no use for and which only adds tracking surface
shared with every other WebView in the app.
Diffstat (limited to 'app')
| -rw-r--r-- | app/src/main/java/org/terst/feedreader/ui/BrowserScreen.kt | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/app/src/main/java/org/terst/feedreader/ui/BrowserScreen.kt b/app/src/main/java/org/terst/feedreader/ui/BrowserScreen.kt index de9416b..f26a35c 100644 --- a/app/src/main/java/org/terst/feedreader/ui/BrowserScreen.kt +++ b/app/src/main/java/org/terst/feedreader/ui/BrowserScreen.kt @@ -97,7 +97,13 @@ fun BrowserScreen(startUrl: String, onBack: () -> Unit) { settings.javaScriptEnabled = true settings.domStorageEnabled = true CookieManager.getInstance().setAcceptCookie(true) - CookieManager.getInstance().setAcceptThirdPartyCookies(this, true) + // Deliberately NOT setAcceptThirdPartyCookies: the login-persistence + // feature this screen exists for (see the class doc comment) only + // needs a site's own FIRST-party session cookie to reach the + // extraction WebView -- third-party cookies are for cross-site + // trackers embedded within whatever page is loaded here, which this + // feature has no use for and which only adds tracking surface shared + // with every other WebView in the app. webViewClient = object : WebViewClient() { override fun onPageFinished(view: WebView, url: String) { title = view.title |