Skip to content

Commit 2a56ecc

Browse files
🔒 [security fix for third party cookies in WebView]
🎯 **What:** Disabled third-party cookies in WebViewLoginScreen.kt. ⚠️ **Risk:** Allowing third-party cookies increases the risk of cross-site tracking and potential CSRF attacks if third-party content is loaded in the WebView. 🛡️ **Solution:** Changed `setAcceptThirdPartyCookies` to `false` to restrict cookies strictly to the first-party domain. Co-authored-by: alvin000009238 <107313913+alvin000009238@users.noreply.github.com>
1 parent fd03a1f commit 2a56ecc

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

android/app/src/main/java/com/clhs/score/ui/WebViewLoginScreen.kt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,7 @@ private fun WebViewContent(
219219

220220
val cookieManager = CookieManager.getInstance()
221221
cookieManager.setAcceptCookie(true)
222-
cookieManager.setAcceptThirdPartyCookies(this, true)
222+
cookieManager.setAcceptThirdPartyCookies(this, false)
223223

224224
val jsInterface = LoginJsInterface { studentNo ->
225225
if (loginHandled || !isTrustedLoginPage) return@LoginJsInterface

0 commit comments

Comments
 (0)