title: Cookies are not stored in android Webview API 21 and up
body: <p><strong>Background</strong>:</p>
  
  <p>I am experiencing a very confusing behaviour with android <code>Webview</code>s in API 21 and up when <strong>testing in real devices</strong>. </p>
  
  <p>I have a local <code>HTML5</code> application (inside assets folder) with the following functionality</p>
  
  <ul>
  <li>Login (2 steps authentication).</li>
  <li>Show a list of items depending on the authentication. </li>
  </ul>
  
  <p><strong>The problem</strong>:</p>
  
  <p>After doing the login requests, the server returns a cookie with the session. This cookie is not stored in the <code>Webview</code> when using real devices with API 21 or up. If I use emulators (Genymotion in this case), the cookies are properly stored. </p>
  
  <p><strong>More information</strong>: </p>
  
  <p>The request to do the auth has the following headers: </p>
  
  <pre><code>POST http://myServer/j_spring_security_check HTTP/1.1
  Proxy-Connection: keep-alive
  Content-Length: 101
  access-control-allow-origin: *
  accept: application/json
  access-control-allow-credentials: true
  User-Agent: Framework/1.5.0 (Linux; U; Android 6.0.1; Nexus 5X Build/MMB29Q) App/0.1.1
  Origin: file://
  content-type: application/x-www-form-urlencoded
  Accept-Language: en-US
  X-Requested-With: app.package
  Host: myServer
  </code></pre>
  
  <p>With the following response:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Server: Apache-Coyote/1.1
  Set-Cookie: JSESSIONID=4D169E8656DBEDFFA4D17FE8D436A5BA; Expires=Fri, 19-Feb-2016 14:27:55 GMT; Path=/; HttpOnly
  Content-Type: application/json;charset=UTF-8
  Content-Length: 43
  Date: Fri, 19 Feb 2016 14:17:55 GMT
  </code></pre>
  
  <p>The cookie is not stored in devices with API 21 or more. Same request/response works fine in the rest of devices + all the emulators</p>
  
  <p><strong>Clarification</strong>:</p>
  
  <ul>
  <li><p>This flags are enabled inside the app:</p>
  
  <pre><code>android.webkit.CookieManager.setAcceptFileSchemeCookies(true);
  </code></pre></li>
  </ul>
  
  <p>(Before CookieManager or webview is instantiated, as <a href="http://developer.android.com/intl/es/reference/android/webkit/CookieManager.html#setAcceptFileSchemeCookies(boolean)" rel="nofollow">documentation</a> says) </p>
  
  <pre><code>if(VERSION.SDK_INT &gt;= 21) {
  
      CookieManager.getInstance().setAcceptThirdPartyCookies(this.nativeWebView, true);
  }
  </code></pre>
  
  <ul>
  <li><p>If after doing the authentication, I access the cookies datastore and
  check the "<a href="http://developer.android.com/intl/es/reference/android/webkit/CookieManager.html#hasCookies()" rel="nofollow">hasCookies</a>" method, I get <code>false</code>.</p></li>
  <li><p>The two step auth service actually calls 3 different paths from the same endpoints. None of the cookies that the response that generate this services are stored. I don't know if this is relevant or not. </p></li>
  <li><p>When doing simple authentication (to a different server), cookies are stored properly in all the devices emulators. </p></li>
  <li><p>I am using Angular 1.5</p></li>
  <li><p>I am aware that the service is using <code>http</code> instead of <code>https</code>. That will be solved in the future. </p></li>
  <li><p>I get no error message in the consoles. </p></li>
  </ul>
  
  <p><strong>Questions:</strong></p>
  
  <p>Is there any internal security measure in the webviews that blocks the storage of the cookies? Why does it work on emulators (that are rooted devices) and not in real devices? This really bugs me. </p>