[Bug]: Logcat showing issues with cookiemanager.cc unable to set secure cookies

[mariusbolik]

What happened?

Hello,

I am seeing this error in logcat:

[ERROR:cookie_manager.cc(135)] Strict Secure Cookie policy does not allow setting a secure cookie for http://onesignal.com/ for apps targeting >= R. Please either use the 'https:' scheme for this URL or omit the 'Secure' directive in the cookie value.

Are there some HTTP Requests not running through https?

Steps to reproduce?

I'm using Capacitor, but I think the Issue still belongs here. The problem was also mentioned in this issue: https://github.com/OneSignal/OneSignal-Android-SDK/issues/1873
I set CapacitorHttp and CapacitorCookies enabled. But I am not sure if this has an effect on the error:

const config: CapacitorConfig = {
  ...
  server: {
    androidScheme: 'https'
  },
  plugins: {
    SplashScreen: {
      launchAutoHide: false
    },
    CapacitorCookies: {
      enabled: true,
      androidCustomSchemeAllowInsecureAccess: true,
    },
    CapacitorHttp: {
      enabled: true,
    }
  }
};

What did you expect to happen?

I would expect the SDK to set cookies correctly or make requests through https.

OneSignal Android SDK version

5.0.3

Android version

13

Specific Android models

Samsung Galaxy s52 5G

Relevant log output

[ERROR:cookie_manager.cc(135)] Strict Secure Cookie policy does not allow setting a secure cookie for http://onesignal.com/ for apps targeting >= R. Please either use the 'https:' scheme for this URL or omit the 'Secure' directive in the cookie value.

Code of Conduct

• I agree to follow this project's Code of Conduct

[jennantilla]

@mariusbolik thank you for reaching out! We are investigating and will get back to you as soon as possible.

[jmonloop]

Hello, is there any update about this one?

[nan-li]

Making a note for investigating this issue that the SDK makes requests to https://api.onesignal.com/. This is probably from a webview's html.

[jmonloop]

Hello. Any update about this one?

[ernes128]

If this helps anybody, I was able to solve it modfying the capacitor.config.ts file and putting the androidScheme into https like this

  server: {
    androidScheme: 'https',
  }

And then in the AndroidManifest, removing the clearTextTraffic attribute. Hope this helps someone.

[nan-li]

Thanks for the suggestion @ernes128,

We haven't heard any new reports of this since, so I will close out this issue.