为什么 Cakephp 安全 cookie 不存储在 WebViewClient 中？

Question

Android WebViewClient 上没有设置 CAKEPHP 安全 cookie 有什么特别的原因吗？

这就是我设置 webviewclient 的方式：

@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);

    String mTargetHostAddr = "mycakeapp";
    String url = String.format("http://%s/users/login", mTargetHostAddr);
    WebView mWebView = (WebView) findViewById(R.id.mWebView);
    mWebView.getSettings().setJavaScriptEnabled(true);
    mWebView.setWebViewClient(new WebViewClient(){
        @Override
        public void onPageFinished(WebView view, String url) {
            super.onPageFinished(view, url);
            CookieManager manager = CookieManager.getInstance();
            manager.hasCookies();
            manager.getCookie(url);
        }
    });
    CookieManager manager = CookieManager.getInstance();
    manager.setAcceptCookie(true); // I turn it on even if the default is true
    mWebView.loadUrl(url);
}

返回：

manager.hasCookies = false;
manager.getCookie = null;

当我尝试使用我的 android 设备浏览器（chrome、firefox）访问 cakephp 应用程序时，它运行良好，这使我可以安全地假设所述浏览器可以获取 cookie。

我还尝试在我的开发框中重现 cakeapp，并返回相同的代码：

manager.hasCookies = true;
manager.getCookie = CAKEPHP=pln5int15o3kp9q1e4c7b3hkt4

关于 Cakephp 配置的更多信息

控制器：

public $components = array(
      'Auth',
      'Session',
);

public function login() {
      $this->layout = 'administrator/login';
      $this->set('title_for_layout', 'Login');
      if ($this->request->is('post')) {
         if ($this->Auth->login()) {
            return $this->redirect($this->Auth->redirect());
         } else {
            $this->Session->setFlash(__d('cakephp', 'Invalid username or password'));
            return $this->redirect($this->Auth->loginAction);
         }
      }
  }

配置/core.php

Configure::write('Session', array(
      'defaults' => 'php',
      'ini' => array(
         'session.cookie_httponly' => 1
      )
));

tail -f /var/log/apache2/mycakeapp-access.log

"GET /users/login HTTP/1.1" 200 3104 "-" "Mozilla/5.0 (Linux; U; Android 4.1.1; en-us; ******* Build/JRO03H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30"

php -v

PHP 5.4.4-14+deb7u11 (cli) (built: Jun 16 2014 13:37:03)
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2012 Zend Technologies

请帮助我知道这可能是一些配置问题，但我无法指出从哪里开始。

相关问题

CakePHP Cookie/Session problems

编辑： 看来我可以通过检查 http 响应标头来隔离问题

[Set-Cookie: CAKEPHP=vigkrm6r9kieo0og7perdh1ga2; expires=Tue, 09-Sep-2014 18:53:08 GMT; Max-Age=14400; path=/; HttpOnly] -- from my dev box
[Set-Cookie: CAKEPHP=r04f7t8f39g8v34370hjvuorg4; expires=Thu, 01-Jan-1970 06:16:19 GMT; path=/; HttpOnly] -- from my production box

Answer 1

expires=Thu, 01-Jan-1970 06:16:19 GMT

不知何故，系统时间变得 FUBAR，因此客户端解析 Cakephp（或任何）cookie 失败。设置系统时间应该可以解决它。

date --set YYYY-MM-DD

// set to hw time
hwclock --systohc

此外，我（松散地）使用来自 apache HttpClient 的自定义 cookie 规范使用此 reference. 忽略无效的到期日期

以下是我的实现：

public class MyCookieSpec extends BrowserCompatSpec {

    public MyCookieSpec() {
        super();
        registerAttribHandler(ClientCookie.EXPIRES_ATTR,
                new BasicExpiresHandler(DATE_PATTERNS) {
                    @Override
                    public void parse(SetCookie cookie, String value)
                            throws MalformedCookieException {
                        // Sun, 26-Jul-1970 21:10:20 GMT
                        SimpleDateFormat format = new SimpleDateFormat("E, dd-MMM-yyyy HH:mm:ss z");
                        Date expDate = null;
                        try {
                            expDate = format.parse(value);
                        } catch (ParseException e) {
                            e.printStackTrace();
                        }

                        if (expDate != null && expDate.after(new Date())) {
                            // Continue if this is a valid value
                            super.parse(cookie, value);
                        } else {
                            // Do whatever you want if the value is not expected
                            long curDate = new Date().getTime();
                            cookie.setExpiryDate(new Date(curDate + 5 * 1000));
                        }
                    }
                });
    }
}

注册规范

HttpClient client = new DefaultHttpClient();
client.getParams().setParameter("http.protocol.version", HttpVersion.HTTP_1_1);
client.getParams().setParameter("http.protocol.cookie-policy", "MY_COOKIE_SPEC");
client.getParams().setParameter("http.protocol.content-charset", "UTF-8");

((AbstractHttpClient) client).getCookieSpecs().register("MY_COOKIE_SPEC", new CookieSpecFactory() {

      @Override
      public CookieSpec newInstance(HttpParams params) {
          return new MyCookieSpec();
      }
});