A native app shares one credential store with its network stack. Inside a WebView that store is walled off: the cookie jar is separate from the system browser and from native HTTP, cross-site cookies are dropped by SameSite rules, and every credentialed fetch needs a CORS handshake the page cannot fully control. A host-owned runtime provides a credential tunnel — one authenticated channel across web and native.
WebView keeps its own cookie jar
On Android, CookieManager is per-WebView-profile and never the system browser's jar. On iOS, WKHTTPCookieStore is separate from NSHTTPCookieStorage, and since iOS 14 the WebView enforces Intelligent Tracking Prevention — third-party cookies expire in seven days and cross-site reads are blocked. A session cookie set by a native login does not automatically reach a fetch() inside the page, so the request comes back 401.
SameSite quietly drops the credential
Chrome 80+ made SameSite=Lax the default and requires Secure on any SameSite=None cookie; iOS 15.4+ binds None to Secure and Partitioned or drops it. So a cookie minted without those attributes is simply not sent on a cross-site request. Combined with CORS, a credentialed fetch needs Access-Control-Allow-Credentials: true and an explicit Access-Control-Allow-Origin (never *) — and a failed preflight throws an opaque TypeError the page cannot inspect.
What breaks when auth crosses the wall
- Login works, then 401s. Native sets the session; the WebView
fetchnever carries it. - Cross-subdomain SSO fails.
login.example.com→app.example.comcookie sync breaks while Safari is fine. - SameSite drops the token. A
Nonecookie withoutSecureis discarded on modern engines. - Preflight throws opaque errors. Debugging a CORS denial is blind — it ties back to the WebView debugging black box.
- Desperate hacks. Some teams reach for
--disable-web-security, impossible in production and a compliance landmine.
The runtime fix
A host-owned runtime owns credentials. The host holds the session in one store and bridges it to the page over a single authenticated channel — attaching the right cookie, honoring SameSite and Secure at the native layer, and proxying cross-origin requests so CORS and preflight are handled where they can be seen. One identity, web and native, every request authenticated.
| Dimension | WebView | Host-owned runtime |
|---|---|---|
| Cookie jar | Separate from system and native | One shared store |
| Cross-site cookie | Dropped by SameSite | Honored at native layer |
| Credentialed fetch | Opaque CORS failure | Tunneled and visible |
| SSO across subdomains | Breaks | Works |
| Preflight debugging | Blind TypeError | Host-logged |
| Secure-by-default | Easy to misconfigure | Enforced |
A native app never loses its session at the network edge. A stock WebView routinely does. A runtime carries one identity across the wall — and authenticates every request.
Sources
- MDN — CORS — the preflight, credentials, and
Access-Control-Allow-Originrules that gate cross-origin requests. - web.dev — SameSite cookies explained — why
Laxis the default andNonerequiresSecure. - Android Developers — CookieManager — the per-profile jar WebView keeps apart from the system browser.
- Apple — WKHTTPCookieStore — the WebView cookie store, separate from
NSHTTPCookieStorage. - Chrome for Developers — SameSite updates — the Chrome 80 default-Lax change that broke unsolicited cross-site cookies.
