Skip to content

fix(webview): set cookies for inline HTML on native#2298

Draft
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/critical-bug-remediation-2794
Draft

fix(webview): set cookies for inline HTML on native#2298
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/critical-bug-remediation-2794

Conversation

@cursor

@cursor cursor Bot commented Jun 22, 2026

Copy link
Copy Markdown

Description

Fixes a native WebView regression from PR #2291 where cookieHeader and cookies were silently ignored when rendering inline HTML.

Bug and impact

Trigger: A screen uses EnsembleWebView with the html property plus cookieHeader or cookies on iOS/Android.

Impact: Session/auth cookies are never applied. Inline HTML that depends on authenticated cookies fails to load protected content, causing login loops or broken embedded flows.

Root cause

PR #2291 added html/htmlBaseUrl support via InAppWebViewInitialData, but setCookie() in native/webviewstate.dart still required url to be non-null. Setting html clears url, so cookie setup returned early without configuring the cookie manager.

Fix

  • Add resolvedWebViewCookieBaseUrl() that falls back to htmlBaseUrl (or the same default used by native initialData) when url is null.
  • Use the resolved base URL in setCookie().
  • Add unit tests for the helper.

How to Test

  1. From modules/ensemble, run flutter test test/webview_cookie_base_url_test.dart.
  2. On a native device/simulator, render a WebView with html, htmlBaseUrl, and cookieHeader; verify the cookie is present for requests from the loaded document.

Duplicate check

Type of Change

  • Bug fix (non-breaking change that fixes an issue)

Checklist

  • I have run flutter analyze and addressed any new warnings
  • I have run flutter test and all tests pass
  • I have tested my changes on the relevant platform(s)
  • I have updated documentation if needed
  • My changes do not introduce new warnings or errors
Open in Web View Automation 

PR #2291 added html/htmlBaseUrl support but setCookie() still required
url to be non-null. Inline HTML mode clears url, so cookieHeader and
cookies were silently ignored on iOS/Android.

Resolve the cookie base URL from url or htmlBaseUrl (with the same
default as InAppWebViewInitialData) and add unit tests.

Co-authored-by: Sharjeel Yunus <sharjeelyunus@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant