Cookies don't appear to save between HTML5 app sessions

[Alan Pope 🍺🐧🐱 🦄]

Created an HTML5 app click package out of https://github.com/clintbellanger/heroine-dusk (with permission from author)

The game saves options and gamestate in cookies at various points through the game.

Install click
Start game
Options
Set some options (music off, minimap on etc) which you remember
Play game
Move around a bit, kill some monsters
Quit game (in the usual unity8 way).
Go back into the game.

Expected behvaiour:-
* Options retained
* [START] option is now [CONTINUE]

Actual behaviour:-
* Options not retained
* [START] option visible

I have tested this on OTA-4 retail krillin, and on a krillin with oxide 1.8.2 from the phablet-team ppa.

[Olivier Tilloy (osomon)]

I tested the click package on my krillin and I’m seeing the same issue.
With oxide 1.7.8, an empty cookies.sqlite database is created in ~/.local/share/heroine-dusk.clintbellanger.
After removing that file and upgrading to oxide 1.8.2 from the phablet-team PPA, the database is not even created (the folder remains empty).

I’m seeing the following apparmor denials in /var/log/syslog when starting the app, if it’s relevant at all:

Jul 2 11:22:41 ubuntu-phablet kernel: [ 537.943277]type=1400 audit(1435828961.373:156): apparmor="DENIED" operation="open" profile="heroine-dusk.clintbellanger_appname_0.1" name="/home/phablet/.cache/QML/Apps/" pid=8484 comm="QQmlThread" requested_mask="r" denied_mask="r" fsuid=32011 ouid=32011
Jul 2 11:22:42 ubuntu-phablet kernel: [ 539.261597]type=1400 audit(1435828962.693:157): apparmor="DENIED" operation="open" profile="heroine-dusk.clintbellanger_appname_0.1" name="/proc/8467/mounts" pid=8467 comm="webapp-containe" requested_mask="r" denied_mask="r" fsuid=32011 ouid=32011
Jul 2 11:22:42 ubuntu-phablet kernel: [ 539.261741]type=1400 audit(1435828962.693:158): apparmor="DENIED" operation="open" profile="heroine-dusk.clintbellanger_appname_0.1" name="/dev/disk/by-label/" pid=8467 comm="webapp-containe" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0

I’m not seeing any relevant info in the app’s log.

[Chris Coulson (chrisccoulson)]

Cookies are disabled for file: URL's. Aside from being a HTTP feature, file: URLs have no hostname and so normal security restrictions wouldn't work properly for them.

Saving options and game state seems like an inappropriate use of cookies anyway.

You can still use localStorage from file URLs (which is what Cut the Rope does). I believe localStorage treats all file: URLs as being in the same domain.