Field notes
Session cookies across web and mobile webviews
— Same site, different clients — why cookie flags that look correct still fail a hardening review.
During application hardening advisory we often inherit a secure code review that already flagged session handling. The remaining work is usually consistency: Secure, HttpOnly, SameSite, domain scope, and refresh behavior across the browser app and embedded webviews.
Typical fracture points
- Native shells that inject cookies differently than Safari or Chrome
- Staging domains that taught the team bad SameSite habits
- Logout that clears local storage but not the refresh cookie
- “Remember me” paths that mint longer-lived tokens without rotation
A practical sequence
- Inventory every place a session is established.
- Align flags to the strictest client you must support.
- Document exceptions with expiry dates, not folklore.
- Re-test logout and idle timeout on each client.
Utility Brook will not pretend one header string fixes every client. We write the matrix with your team and re-check after changes.