Cookies

WebViewCookieManager manages cookies for WebViews owned by the underlying engine.

final cookies = WebViewCookieManager();

await cookies.setCookie(
  const WebViewCookie(
    name: 'session',
    value: 'abc',
    domain: 'example.com',
    path: '/',
  ),
);

final list = await cookies.getCookies(domain: Uri.parse('https://example.com'));
final hadCookies = await cookies.clearCookies();

Common API

Method	Behavior
setCookie(WebViewCookie cookie)	Sets a cookie with name, value, domain, and path.
getCookies({required Uri domain})	Returns cookies visible for the provided domain or URL.
clearCookies()	Removes cookies and returns whether cookies were present when the platform can report it.

Cookie validation rejects empty names, browser-rejected characters, and invalid paths. A non-empty path must start with /.

Platform Behavior

Platform	Storage	Notes
Android	Android WebView CookieManager.	Preserves encoded names/values and values containing =; supports third-party cookie policy.
iOS/macOS	WKWebsiteDataStore.defaultDataStore.	Filters getCookies by RFC-style domain matching.
Windows	WebView2 cookie manager.	Exposes extended cookie metadata through WindowsWebViewCookie.
Linux	WebKitGTK cookie manager bridge.	Common cookie fields are supported.
Web	document.cookie.	Limited to cookies visible to the host page origin. HttpOnly cookies are not readable from JavaScript.

To clear cookies together with cache and DOM storage, use WebViewStorageManager().removeData(); it does not require a live controller. On web this only affects the host origin.

Windows Full Cookie API

Windows exposes WebView2 cookie metadata:

final manager = WebViewCookieManager().platform
    as WindowsWebViewCookieManager;

await manager.setWindowsCookie(
  WindowsWebViewCookie(
    name: 'session',
    value: 'abc',
    domain: 'example.com',
    path: '/',
    isHttpOnly: true,
    isSecure: true,
    sameSite: WindowsWebViewCookieSameSite.lax,
    expires: DateTime.now().add(const Duration(days: 7)),
  ),
);

final cookies = await manager.getWindowsCookies(
  Uri.parse('https://example.com'),
);

await manager.deleteCookiesWithNameAndUrl(
  name: 'session',
  url: Uri.parse('https://example.com'),
);

Android Third-Party Cookies

final manager = WebViewCookieManager().platform
    as AndroidWebViewCookieManager;
final androidController = controller.platform as AndroidWebViewController;

await manager.setAcceptThirdPartyCookies(androidController, true);

Web Cookie Limits

The web implementation uses document.cookie, so it follows browser JavaScript cookie limits:

• It cannot read HttpOnly cookies.
• It cannot clear cookies for unrelated domains.
• It cannot bypass SameSite, Secure, partitioning, or browser privacy rules.
• getCookies returns data only for the exact current document scheme, host, and path; other URL contexts return an empty list.
• Returned cookies use the current document host and / because document.cookie does not expose their original domain/path attributes.
• clearCookies is best effort across visible parent domain/path candidates and returns true only when at least one visible cookie disappears.