Manage web storage and cookies

[muodov]

Manage web storage and cookies

Submitter(s)

Maxim Tsoy (DuckDuckGo)

Motivation

Apps loading 3rd-party web content in WebViews may need more granular control over stored data. For example, DuckDuckGo browsers need this for the Fireproof feature, which allows to make exceptions to the cookie/storage removal.

Stakeholders

Browsers based on WebView
WebView vendors

Analysis

• Webkit provides APIs to retrieve cookies and local/sessionStorage as opaque tokens that can be filtered by hostname. This allows selective removal, although it requires some extra code and workarounds to prevent timing issues (removal is asynchronous).
• in Webkit, storage is shared between all WKWebView instances, unless it's "non persistent" (in memory), which is not ideal for building web browsers
• in Android WebView, it is not possible to inspect cookie scopes. You can retrieve cookie names and values, but without knowing other attributes it is impossible to override them properly
• Android WebView does not provide APIs to manage localStorage/sessionStorage

Related W3C deliverables and/or work items

How is the issue solved in the Browser, and what’s more is needed?

Browsers manage storage using APIs of a specific rendering engine.

[aluhrs13]

WebView2 on Windows allows managing access, creation, copy, deletion of cookies through a Cookie Manager API. Other storage would need to be accessed through DevTools Protocol APIs using the Storage and/or DOMStorage domains.

[QingAn]

As discussed in 2022-08-23 meeting, we agreed it is a valid use case.