title: iOS Web App doesn't set cookie in the first place
body: <p>I have seen lots of questions and answers on how to permanently store a cookie in an iOS web application... But I can't seem to even get this one set.</p>
  
  <p>The application runs beautifully in a real desktop browser, but fails when running inside of an iOS app.</p>
  
  <p>I have a rails web service UI that the app communicates, but all of the app logic and code is on the client using Backbone, jQuery, etc...</p>
  
  <p>A form submits the user login information to the web service via an AJAX POST:</p>
  
  <pre><code>$.ajax({url: 'http://mydomain.fake/login',
              type: 'POST',
              data: data,
              xhrFields: { withCredentials: true },
              success: successFunc,
              error: errorFunc});
  </code></pre>
  
  <p>The server then authenticates the user and FOR NOW sends back an encrypted permanent cookie with the user's identity:</p>
  
  <pre><code>def login
    @account = Account.find_by(email: params[:email]).try(:authenticate, params[:password])
    unless @account.nil? || @account == false
      cookies.permanent.signed[:user] = @account
      return head :ok
    end
    head :unauthorized
  end
  </code></pre>
  
  <p>Connecting to the app with safari and checking the response to this call I get back the appropriate cookie header:</p>
  
  <pre><code>Set-Cookie  user=&lt;encrypted string&gt;; path=/; expires=Fri, 29 Sep 2034 01:50:31 -0000
  </code></pre>
  
  <p>Now when checking <code>document.cookie</code> there is nothing there. Looking on in the resources on the left of Safari, there are no cookies. And when refreshing, the same symptoms as above, and the application has no idea who the user is and returns them back to the login page...</p>
  
  <p>Does anyone have any idea why the application cannot store the cookie. I am not closing and re-opening the application, so this is not an issue with the known (safari deletes the cookies on close) or (applications are sandboxed) or (an expiration time on the cookie has not been set). I am thoroughly confused.</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>I added the CORS headers to the web server, though they seem not to be needed, but no difference was achieved. I'm still at a loss for how something that usually <em>just-works</em> isn't, and would love any help/pointers/links/anything that might help get me back on track. I am currently stuck.</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>I switched from using jQuery to a phonegap plugin that uses native Obj-C to make a request to the server. The request succeeded, but still no cookie is set. I am convinced I am doing something very wrong here.</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>I now have tried using jQuery cookie to set an encrypted string sent by the server and setting it that way. It works, but only if I don't set the domain on the cookie.</p>
  
  <pre><code>$.cookie('user', data.token, {
           expires: new Date(2014,12,31), 
           domain: 'localhost', 
           path: '/'});
  </code></pre>
  
  <p>I'm sure that this is a CORS security feature where you cannot set another domain other than the domain you are working on. But my test server is at <code>localhost:3000</code> and my test app is running from <code>localhost:63342</code> so I was setting the cookie domain to <code>localhost</code>. This wouldn't pass my desktop browser testing so I never did try it in iOS since I can't even get it to work here.</p>
  
  <p>So I guess to modify my question How <em>should</em> I authenticate my users to the webservice and store something (like a token) so that I can identify users on subsequent visits...</p>
  
  <p><strong>Update:</strong>
  I do have these headers set in my web service. I set the <code>Allow-Origin</code> to another domain I own because I can't list out every origin of every user. Unless should it be set to <code>localhost</code> or something for them?</p>
  
  <pre><code>'Access-Control-Allow-Origin' =&gt; '&lt;what should I put here&gt;',
  'Access-Control-Request-Method' =&gt; '*',
  'Access-Control-Allow-Credentials' =&gt; 'true',
  'Access-Control-Allow-Methods' =&gt; 'GET, POST, PATCH, PUT, DELETE, OPTIONS, HEAD',
  'Access-Control-Allow-Headers' =&gt; 'Origin, Accept, Content-Type, Cookie'
  </code></pre>
  
  <p>Either way the webview produces <em>no</em> CORS errors, unlike actual safari or a desktop browser (even if I don't have them set at all).</p>