From a5f728648dda46e84959a4568a3f04d5cc7bb11f Mon Sep 17 00:00:00 2001 From: Peter Stone Date: Sat, 22 Aug 2026 01:08:42 +0000 Subject: BrowserScreen: don't accept third-party cookies This screen exists so a site's own first-party login session cookie survives into the reader's later extraction requests -- that's all the login-persistence feature needs. Third-party cookies are for cross-site trackers embedded in whatever page is loaded here, which this feature has no use for and which only adds tracking surface shared with every other WebView in the app. --- app/src/main/java/org/terst/feedreader/ui/BrowserScreen.kt | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'app/src/main/java') diff --git a/app/src/main/java/org/terst/feedreader/ui/BrowserScreen.kt b/app/src/main/java/org/terst/feedreader/ui/BrowserScreen.kt index de9416b..f26a35c 100644 --- a/app/src/main/java/org/terst/feedreader/ui/BrowserScreen.kt +++ b/app/src/main/java/org/terst/feedreader/ui/BrowserScreen.kt @@ -97,7 +97,13 @@ fun BrowserScreen(startUrl: String, onBack: () -> Unit) { settings.javaScriptEnabled = true settings.domStorageEnabled = true CookieManager.getInstance().setAcceptCookie(true) - CookieManager.getInstance().setAcceptThirdPartyCookies(this, true) + // Deliberately NOT setAcceptThirdPartyCookies: the login-persistence + // feature this screen exists for (see the class doc comment) only + // needs a site's own FIRST-party session cookie to reach the + // extraction WebView -- third-party cookies are for cross-site + // trackers embedded within whatever page is loaded here, which this + // feature has no use for and which only adds tracking surface shared + // with every other WebView in the app. webViewClient = object : WebViewClient() { override fun onPageFinished(view: WebView, url: String) { title = view.title -- cgit v1.2.3