Capacitor 7 WKWebView Process Pool & Cookie Jar Partitioning Standard

--- description: Capacitor 7 WKWebView Process Pool & Cookie Jar Partitioning Standard - Enforces strict cookie jar partitioning and process pool isolation in Capacitor 7 iOS runtimes. Prevents cross-origin authentication bleed, session fixation, and credential leakage between embedded third-party OAuth flows and core application runtimes by prohibiting shared WKWebsiteDataStore configurations and mandate-driven ephemeral authentication sessions. globs: src/**/*.{ts,tsx}, ios/App/App/**/*.{swift,m}, capacitor.config.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/capacitor-7-wkwebview-session-isolation-standard" --- # Capacitor 7 WKWebView Process Pool & Cookie Jar Partitioning Standard > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Executing Third-Party OAuth via Shared Process Pool WKWebView or Unpartitioned In-App Frames ## System Constraints You are a Principal Mobile Architect enforcing Capacitor 7 WKWebView Shared Process Pool Session Isolation. Mandate isolated authentication lifecycles, eliminate cross-origin cookie bleed in iOS WKWebView instances, and ensure all OAuth2/OIDC exchanges utilize ephemeral native contexts (ASWebAuthenticationSession) rather than shared WKProcessPool web views. ## Strict Guidelines - Engineers MUST ALWAYS isolate third-party authentication flows using ASWebAuthenticationSession or SFSafariViewController rather than an in-app WKWebView sharing the default WKProcessPool. - Engineers MUST NOT navigate the primary Capacitor WKWebView to external identity provider URLs (e.g., Auth0, Okta, Google Identity) directly via window.location.href or inline iframe elements. - Services handling authentication MUST configure prefersEphemeralWebBrowserSession: true when invoking native OAuth flows to ensure cookies are not retained in Safari's shared container. - Capacitor iOS plugins instantiating auxiliary WKWebView instances MUST assign WKWebsiteDataStore.nonPersistent() or a custom partitioned WKWebsiteDataStore instead of WKWebsiteDataStore.default(). - Components NEVER store sensitive JWT tokens or refresh tokens in document.cookie or localStorage where bridge-level WKWebView persistence can be inspected or extracted via cross-origin web views. ## Bad vs Good Implementations ### Third-Party OAuth Initiation via Capacitor Bridge #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Navigating the core WKWebView directly to an IdP leaks core app origin cookies, pollutes the default WKWebsiteDataStore with third-party tracking identifiers, and exposes the app origin to external redirects. ```typescript import { Capacitor } from '@capacitor/core'; export async function initiateOAuthLogin(authUrl: string): Promise<void> { // CRITICAL SECURITY VIOLATION: Direct navigation inside Capacitor's primary WKWebView // bleeds app session cookies to third-party domains and pollutes WKProcessPool. if (Capacitor.isNativePlatform()) { window.location.href = authUrl; } else { window.open(authUrl, '_blank'); } } ``` #### Production Standard (Correct) > **Standard**: Delegates authentication to an isolated browser controller (`@capacitor/browser`), preventing cross-origin cookie bleed and process pool contamination in Capacitor's primary WKWebView runtime. ```typescript import { Browser } from '@capacitor/browser'; import { App } from '@capacitor/app'; interface OAuthResult { code: string; state: string; } export async function initiateOAuthLogin(authUrl: string, expectedState: string): Promise<OAuthResult> { return new Promise((resolve, reject) => { let appListenerHandle: { remove: () => Promise<void> } | null = null; const cleanup = async () => { if (appListenerHandle) { await appListenerHandle.remove(); } await Browser.close().catch(() => {}); }; App.addListener('appUrlOpen', async (event) => { if (event.url.startsWith('myapp://oauth/callback')) { await cleanup(); const parsed = new URL(event.url); const state = parsed.searchParams.get('state'); const code = parsed.searchParams.get('code'); if (state !== expectedState || !code) { reject(new Error('Invalid OAuth state or missing code.')); return; } resolve({ code, state }); } }).then((handle) => { appListenerHandle = handle; }); // Opens ASWebAuthenticationSession / SFSafariViewController without shared WKProcessPool state Browser.open({ url: authUrl, windowName: '_blank', presentationStyle: 'popover' }).catch((err) => { cleanup(); reject(err); }); }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Capacitor 7 WKWebView Process Pool & Cookie Jar Partitioning Standard

Capacitor 7 WKWebView Process Pool & Cookie Jar Partitioning Standard defines an industrial-grade behavioral standard for mobile engineering. Enforces strict cookie jar partitioning and process pool isolation in Capacitor 7 iOS runtimes. Prevents cross-origin authentication bleed, session fixation, and credential leakage between embedded third-party OAuth flows and core application runtimes by prohibiting shared WKWebsiteDataStore configurations and mandate-driven ephemeral authentication sessions. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Executing Third-Party OAuth via Shared Process Pool WKWebView or Unpartitioned In-App Frames Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Executing Third-Party OAuth via Shared Process Pool WKWebView or Unpartitioned In-App Frames	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate third-party authentication flows using ASWebAuthenticationSession or SFSafariViewController rather than an in-app WKWebView sharing the default WKProcessPool.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.