[webview_flutter] Implement getCookies #10833

khaled-0 · 2026-01-20T13:13:35Z

This pr adds a way to retrive cookies from webview by using native platform api provided by CookieManager and WKHTTPCookieStore

Addresses flutter/flutter#27795

Pre-Review Checklist

If you need help, consider asking for advice on the #hackers-new channel on Discord.

Note: The Flutter team is currently trialing the use of Gemini Code Assist for GitHub. Comments from the gemini-code-assist bot should not be taken as authoritative feedback from the Flutter team. If you find its comments useful you can update your code accordingly, but if you are unsure or disagree with the feedback, please feel free to wait for a Flutter team member's review for guidance on which automated comments should be addressed.

Regular contributors who have demonstrated familiarity with the repository guidelines only need to comment if the PR is not auto-exempted by repo tooling. ↩ ↩² ↩³

…ookies

Caveats: Domain name can not be null

flutter-dashboard · 2026-01-20T13:13:39Z

It looks like this pull request may not have tests. Please make sure to add tests or get an explicit test exemption before merging.

If you are not sure if you need tests, consider this rule of thumb: the purpose of a test is to make sure someone doesn't accidentally revert the fix. Ask yourself, is there anything in your PR that you feel it is important we not accidentally revert back to how it was before your fix?

Reviewers: Read the Tree Hygiene page and make sure this patch meets those guidelines before LGTMing. If you believe this PR qualifies for a test exemption, contact "@test-exemption-reviewer" in the #hackers channel in Discord (don't just cc them here, they won't see it!). The test exemption team is a small volunteer group, so all reviewers should feel empowered to ask for tests, without delegating that responsibility entirely to the test exemption group.

khaled-0 · 2026-01-20T13:14:28Z

I don't know how I should go about writing test for this change, so I'm looking for suggestions.

gemini-code-assist

Code Review

This pull request introduces the getCookies method to WebViewCookieManager, enabling retrieval of cookies from webviews on both Android and iOS/macOS. The implementation is backed by native platform APIs. My review identifies a few critical issues in the platform-specific implementations. On Android, the cookie string parsing is not robust and can fail if cookie values contain certain characters. On the WebKit (iOS/macOS) side, there's an unsafe access to cookie properties that could lead to creating invalid WebViewCookie objects. I've also suggested a small improvement to the WebViewCookie.toString() method for better debuggability.

gemini-code-assist · 2026-01-20T13:26:22Z

packages/webview_flutter/webview_flutter_android/lib/src/android_webview_cookie_manager.dart

+    final List<WebViewCookie> webViewCookies = List.of([]);
+    for (final String cookie in cookies.split('; ')) {
+      final List<String> cookieValue = cookie.split('=');
+      webViewCookies.add(
+        WebViewCookie(
+          name: cookieValue.first,
+          value: cookieValue.last,
+          domain: domain.toString(),
+        ),
+      );
+    }


The current cookie parsing logic using cookie.split('=') and accessing .first and .last is not robust. If a cookie's value contains an = character, the value will be truncated, and only the part after the last = will be used. This leads to incorrect cookie values.

A safer approach is to find the first occurrence of = to separate the name and value. Also, initializing the list with <WebViewCookie>[] is more idiomatic than List.of([]).

final List<WebViewCookie> webViewCookies = <WebViewCookie>[]; for (final String cookie in cookies.split('; ')) { final int separatorIndex = cookie.indexOf('='); if (separatorIndex == -1) { continue; } webViewCookies.add( WebViewCookie( name: cookie.substring(0, separatorIndex), value: cookie.substring(separatorIndex + 1), domain: domain.toString(), ), ); }

It won't, because cookies are URL encoded

gemini-code-assist · 2026-01-20T13:26:22Z

packages/webview_flutter/webview_flutter_wkwebview/lib/src/webkit_webview_cookie_manager.dart

+      return WebViewCookie(
+        name: props[HttpCookiePropertyKey.name].toString(),
+        value: props[HttpCookiePropertyKey.value].toString(),
+        domain: props[HttpCookiePropertyKey.domain].toString(),
+        path: props[HttpCookiePropertyKey.path].toString(),
+      );


The current implementation for creating a WebViewCookie from properties is unsafe. It uses .toString() on map values that can be null. If a property like name, value, or domain is missing from the props map, this will result in a WebViewCookie with fields containing the string 'null', which is incorrect. For path, it should fall back to the default value '/' if it's missing.

For required fields like name, value, and domain, if they are missing, the cookie is invalid and should be skipped.

final Object? name = props[HttpCookiePropertyKey.name]; final Object? value = props[HttpCookiePropertyKey.value]; final Object? domain = props[HttpCookiePropertyKey.domain]; if (name == null || value == null || domain == null) { return null; } return WebViewCookie( name: name.toString(), value: value.toString(), domain: domain.toString(), path: props[HttpCookiePropertyKey.path]?.toString() ?? '/', );

gemini-code-assist · 2026-01-20T13:26:22Z

packages/webview_flutter/webview_flutter_platform_interface/lib/src/types/webview_cookie.dart

+
+  @override
+  String toString() {
+    return 'WebViewCookie{name: $name, domain: $domain, path: $path}';


The toString() implementation omits the value of the cookie. Including the value would be very helpful for debugging purposes.

Suggested change

return 'WebViewCookie{name: $name, domain: $domain, path: $path}';

return 'WebViewCookie{name: $name, value: $value, domain: $domain, path: $path}';

toString more often than not, is for debugging only (sometimes the compiler will optimize this override out). I wonder what is WebViewCookie toString for (is it still debug-only?) and why value shouldn't be included?

stuartmorgan-g · 2026-01-20T19:20:47Z

All existing and new tests are passing.

Please follow these instructions so that CI can run.

I don't know how I should go about writing test for this change, so I'm looking for suggestions.

What specifically are you looking for in terms of guidance here? Have you looked at the existing tests (native and Dart) for these packages? We have significant test coverage, so there should be clear examples to follow.

swift-format reformatted the entire HTTPCookieStoreProxyAPITests.swift

…okie

GCC_TREAT_WARNINGS_AS_ERRORS = YES (no-shit)

khaled-0 · 2026-01-21T18:48:24Z

@stuartmorgan-g all relevant tests are passing now
I have added cookie related tests as well

stuartmorgan-g · 2026-01-21T19:18:29Z

Adding to the review triage queues.

The tool-created changes to webview_flutter_web can be reverted since there are no actual changes in that package.

LongCatIsLooong · 2026-01-21T19:17:16Z

packages/webview_flutter/webview_flutter/lib/src/webview_cookie_manager.dart

  /// This is a no op on iOS versions below 11.
  Future<void> setCookie(WebViewCookie cookie) => platform.setCookie(cookie);
+
+  /// Gets a list of existing cookie for all or specified domain for all WebViews.


What does "all WebViews" mean? All webviews in the app or in the device?

in the app. should be obvious. I used existing comments as a reference

LongCatIsLooong · 2026-01-21T19:25:53Z

packages/webview_flutter/webview_flutter_platform_interface/lib/src/types/webview_cookie.dart

+
+  @override
+  String toString() {
+    return 'WebViewCookie{name: $name, domain: $domain, path: $path}';


toString more often than not, is for debugging only (sometimes the compiler will optimize this override out). I wonder what is WebViewCookie toString for (is it still debug-only?) and why value shouldn't be included?

LongCatIsLooong · 2026-01-21T19:27:03Z

...view_flutter/webview_flutter_platform_interface/lib/src/platform_webview_cookie_manager.dart

  }
+
+  /// Gets a list of existing cookie for all or specified domain for all WebViews.
+  /// Android: Entire domain must be provided alongside scheme


nit: this needs a new line after the first paragraph.

Same question regarding all WebViews. Also, something like sounds a bit more explicit about how to get cookies for all domains:

Gets a list of existing cookies for all WebViews for the specified domain, or for all domains if domain is not specified.

LongCatIsLooong · 2026-01-21T19:28:30Z

...view_flutter/webview_flutter_platform_interface/lib/src/platform_webview_cookie_manager.dart

+
+  /// Gets a list of existing cookie for all or specified domain for all WebViews.
+  /// Android: Entire domain must be provided alongside scheme
+  /// iOS: ignores scheme and supports partial match based on host


nit: missing periods at the end of both sentences (here and everywhere). Also macOS?

iOS and MacOS, I'll update the comments

LongCatIsLooong · 2026-01-21T19:46:37Z

...ew_flutter_wkwebview/Sources/webview_flutter_wkwebview/HTTPCookieStoreProxyAPIDelegate.swift

+    domain: String?,
+    completion: @escaping (Result<[HTTPCookie], any Error>) -> Void
+  ) {
+    if domain == nil {


uber nit: could you get rid of the ! by using if let / guard let?

LongCatIsLooong · 2026-01-21T19:50:09Z

...ew_flutter_wkwebview/Sources/webview_flutter_wkwebview/HTTPCookieStoreProxyAPIDelegate.swift

+    }
+
+    pigeonInstance.getAllCookies { cookies in
+      completion(.success(cookies.filter { $0.domain.contains(domain!) }))


if we're doing the filtering ourselves, then why do we have the limitation that Android can only do full domain matching (And also does this have to be part of the API? since the caller can do that themselves too)?

we're only doing the filtering on ios/macos side. (to match behavior on both platform)

Android has no way of getting cookies for all domain so passing a specific domain is necessary.

LongCatIsLooong · 2026-01-21T19:52:40Z

packages/webview_flutter/webview_flutter_wkwebview/example/lib/main.dart

-        await webViewController.runJavaScriptReturningResult('document.cookie')
-            as String;
+    final Uri? domain = Uri.tryParse(
+      (await webViewController.currentUrl()) ?? '',


Hmm this changes the behavior of the sample app I think? If currentUrl is null before the change the page would be empty right?

well yes kinda, it would print all the cookies for all domain if currentUrl is null for ios/macos

khaled-0 added 4 commits January 20, 2026 17:26

[webview_flutter] Create method for retriving cookies

115fecc

[webview_flutter_wkwebview] Implement getCookies method to retrieve c…

ca32485

…ookies

[webview_flutter_android] Implement getCookies method

bf04b65

Caveats: Domain name can not be null

[webview_flutter_platform_interface] Use Uri for getCookies

bb96ade

khaled-0 requested review from LongCatIsLooong, bparrishMines and hellohuanlin as code owners January 20, 2026 13:13

github-actions bot added platform-android platform-ios platform-macos p: webview_flutter labels Jan 20, 2026

gemini-code-assist bot reviewed Jan 20, 2026

View reviewed changes

stuartmorgan-g added the federated: all_changes PR that contains changes for all packages for a federated plugin change label Jan 20, 2026

[webview_flutter] make-deps-path-based (temp)

f79d7e8

khaled-0 requested a review from mdebbar as a code owner January 21, 2026 14:30

github-actions bot added the platform-web label Jan 21, 2026

khaled-0 added 6 commits January 21, 2026 22:20

[webview_flutter] test for getCookies in PlatformWebViewCookieManage

f3186cb

[webview_flutter_android] test for getCookies

088ccda

[webview_flutter_wkwebview] test for getCookies

7bc3de2

swift-format reformatted the entire HTTPCookieStoreProxyAPITests.swift

[webview_flutter] Use CookieManager.getCookies instead of document.co…

04995bd

…okie

[webview_flutter] Format with flutter_plugin_tools format

1a11291

[webview_flutter_wkwebview] match getAllCookies function signature

1317fc6

GCC_TREAT_WARNINGS_AS_ERRORS = YES (no-shit)

stuartmorgan-g added triage-ios Should be looked at in iOS triage triage-android Should be looked at in Android triage labels Jan 21, 2026

LongCatIsLooong reviewed Jan 21, 2026

View reviewed changes

mdebbar removed their request for review January 22, 2026 15:39

	return 'WebViewCookie{name: $name, domain: $domain, path: $path}';
	return 'WebViewCookie{name: $name, value: $value, domain: $domain, path: $path}';

[webview_flutter] Implement getCookies #10833

Are you sure you want to change the base?

[webview_flutter] Implement getCookies #10833

Uh oh!

Conversation

khaled-0 commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pre-Review Checklist

Footnotes

Uh oh!

flutter-dashboard bot commented Jan 20, 2026

Uh oh!

khaled-0 commented Jan 20, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stuartmorgan-g commented Jan 20, 2026

Uh oh!

khaled-0 commented Jan 21, 2026

Uh oh!

stuartmorgan-g commented Jan 21, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

khaled-0 Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

khaled-0 commented Jan 20, 2026 •

edited

Loading

khaled-0 Jan 22, 2026 •

edited

Loading