Fix ASC sign-in never remembering "Trust This Browser" - #26
Open
24leviii-arch wants to merge 1 commit into
Open
Conversation
AppleIDLoginSheet's WKWebView used a `.nonPersistent()` data store, which discards all cookies (including Apple's own device-trust cookie) the instant the sign-in sheet closes. That forces idmsa's 2FA flow to re-verify and re-prompt "Trust This Browser" on every single sign-in, and checking that box can never have any effect, since nothing survives afterward for it to persist into. Switch to a persistent, identifier-scoped WKWebsiteDataStore so the WebView remembers the ASC/Apple ID session (and device trust) across launches, the same way a normal browser would — while staying fully isolated from the user's actual Safari data. The cookie-capture flow that feeds ASCWebSessionStore is unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AppleIDLoginSheet'sASCWebViewconfigures itsWKWebViewwith.nonPersistent():That discards every cookie — including Apple's own device-trust cookie — the moment the sign-in sheet closes. Since the WebView has no memory between launches, idmsa's 2FA flow has no choice but to re-verify and re-show "Trust This Browser" on every single sign-in. Checking that box can never have any effect, because there's nothing left afterward for it to persist into. It's not a case of the trust not "sticking" — there's no storage for it to stick to at all.
Fix
Swap the ephemeral store for a persistent, identifier-scoped one:
WKWebsiteDataStore(forIdentifier:)gives the WebView its own persistent, on-disk data store that's fully isolated from the user's actual Safari data (nothing shared, nothing leaked), but does survive between app launches — so cookies and Apple's device-trust state can actually persist the way they would in a normal browser. Available since macOS 14, which matches this project's deployment target.The cookie-capture flow that feeds
ASCWebSessionStore(polling formyacinfo, then extracting cookies via theolympus/v1/sessioncall) is completely unchanged — this only changes where the WebView's own state lives.Testing
swift build --target Blitzsucceeds with this change (verified locally).Fixes the recurring "asks to trust the browser every time, trusting it does nothing" issue reported by a user.