From 2a56eccc4e2f960ca0fcc07c60fa8b8534633b48 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 17 Jun 2026 14:35:51 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20[security=20fix=20for=20third=20?=
 =?UTF-8?q?party=20cookies=20in=20WebView]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🎯 **What:** Disabled third-party cookies in WebViewLoginScreen.kt.
⚠️ **Risk:** Allowing third-party cookies increases the risk of cross-site tracking and potential CSRF attacks if third-party content is loaded in the WebView.
🛡️ **Solution:** Changed `setAcceptThirdPartyCookies` to `false` to restrict cookies strictly to the first-party domain.

Co-authored-by: alvin000009238 <107313913+alvin000009238@users.noreply.github.com>
---
 .../app/src/main/java/com/clhs/score/ui/WebViewLoginScreen.kt   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/android/app/src/main/java/com/clhs/score/ui/WebViewLoginScreen.kt b/android/app/src/main/java/com/clhs/score/ui/WebViewLoginScreen.kt
index 576243a..a3689ae 100644
--- a/android/app/src/main/java/com/clhs/score/ui/WebViewLoginScreen.kt
+++ b/android/app/src/main/java/com/clhs/score/ui/WebViewLoginScreen.kt
@@ -219,7 +219,7 @@ private fun WebViewContent(
 
                 val cookieManager = CookieManager.getInstance()
                 cookieManager.setAcceptCookie(true)
-                cookieManager.setAcceptThirdPartyCookies(this, true)
+                cookieManager.setAcceptThirdPartyCookies(this, false)
 
                 val jsInterface = LoginJsInterface { studentNo ->
                     if (loginHandled || !isTrustedLoginPage) return@LoginJsInterface