Skip to content

Fix ASC sign-in never remembering "Trust This Browser" - #26

Open
24leviii-arch wants to merge 1 commit into
blitzdotdev:masterfrom
24leviii-arch:fix/asc-web-login-persistent-cookies
Open

Fix ASC sign-in never remembering "Trust This Browser"#26
24leviii-arch wants to merge 1 commit into
blitzdotdev:masterfrom
24leviii-arch:fix/asc-web-login-persistent-cookies

Conversation

@24leviii-arch

Copy link
Copy Markdown

Summary

AppleIDLoginSheet's ASCWebView configures its WKWebView with .nonPersistent():

let config = WKWebViewConfiguration()
config.websiteDataStore = .nonPersistent()

That discards every cookie — including Apple's own device-trust cookie — the moment the sign-in sheet closes. Since the WebView has no memory between launches, idmsa's 2FA flow has no choice but to re-verify and re-show "Trust This Browser" on every single sign-in. Checking that box can never have any effect, because there's nothing left afterward for it to persist into. It's not a case of the trust not "sticking" — there's no storage for it to stick to at all.

Fix

Swap the ephemeral store for a persistent, identifier-scoped one:

private static let persistentStoreID = UUID(uuidString: "6F1B2C3D-4E5F-4A6B-8C7D-9E0F1A2B3C4D")!
...
config.websiteDataStore = WKWebsiteDataStore(forIdentifier: Self.persistentStoreID)

WKWebsiteDataStore(forIdentifier:) gives the WebView its own persistent, on-disk data store that's fully isolated from the user's actual Safari data (nothing shared, nothing leaked), but does survive between app launches — so cookies and Apple's device-trust state can actually persist the way they would in a normal browser. Available since macOS 14, which matches this project's deployment target.

The cookie-capture flow that feeds ASCWebSessionStore (polling for myacinfo, then extracting cookies via the olympus/v1/session call) is completely unchanged — this only changes where the WebView's own state lives.

Testing

  • swift build --target Blitz succeeds with this change (verified locally).
  • Minimal, single-file diff; no changes to the cookie-extraction/session-store logic.

Fixes the recurring "asks to trust the browser every time, trusting it does nothing" issue reported by a user.

AppleIDLoginSheet's WKWebView used a `.nonPersistent()` data store,
which discards all cookies (including Apple's own device-trust cookie)
the instant the sign-in sheet closes. That forces idmsa's 2FA flow to
re-verify and re-prompt "Trust This Browser" on every single sign-in,
and checking that box can never have any effect, since nothing survives
afterward for it to persist into.

Switch to a persistent, identifier-scoped WKWebsiteDataStore so the
WebView remembers the ASC/Apple ID session (and device trust) across
launches, the same way a normal browser would — while staying fully
isolated from the user's actual Safari data. The cookie-capture flow
that feeds ASCWebSessionStore is unchanged.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant