IPhone : How to clear iPhone cookies after logout event

on Saturday, April 18, 2015

My iOS app utilizes session cookies to authenticate users to our APIs. The app offer a "logout" functionality. In order to log the user out, I try to delete the current cookies, which will make the server ask for authentication the next time the user tries to use the app (as the session cookies has been deleted).


However, I have noted that the code I am using to delete the cookies does not delete them, and users can access our API content right after a logout event without being asked for authentication.


The cookies are being deleted by this code:



NSHTTPCookieStorage *storage = [NSHTTPCookieStorage sharedHTTPCookieStorage];
NSHTTPCookie *cookie;
for (cookie in [storage cookies]) {
[storage deleteCookie:cookie];
}


Network operations, such as login/logout, are being performed by a network helper, which is called from the app's code in and returns an instance of itself and its methods:



+ (NetworkHelper *)getInstance
{
@synchronized(self)
{
if(instance==nil)
{
instance= [NetworkHelper new];
instance.sessionConfiguration = [NSURLSessionConfiguration defaultSessionConfiguration];
instance.session = [NSURLSession sessionWithConfiguration:instance.sessionConfiguration];
instance.protectionSpace = [[NSURLProtectionSpace alloc] initWithHost:@"www.heldendervolksmusik.com" port:443 protocol:@"https" realm:nil authenticationMethod:nil];

//reads configuration file
instance.clientConfiguration = [instance readConfigurationFile];

//sets token url
instance.tokenUrl = [NSURL URLWithString:[NSString stringWithFormat:@"%@%@",
instance.clientConfiguration[@"hdv_production_uri"],
@"/token"]];

NSHTTPCookieStorage *storage = [NSHTTPCookieStorage sharedHTTPCookieStorage];
NSArray *cookies = [[NSHTTPCookieStorage sharedHTTPCookieStorage] cookies];

for (NSHTTPCookie *cookie in cookies) {
NSLog(@"%@, %@", cookie.name, cookie.value);
}
}
return instance;
}
}


What's interesting is that, even when instance==nil is true, the session cookie is still printed to the console (look at the lines just before the return instance; statement.


I am not sure if there is something wrong about how the cookies are being deleted, or if the way we are creating network helper instance introduces this unexpected behaviour.


0 comments:

Post a Comment