fetch API on Android doesn't respect credentials: omit

Description

If Android’s native networking library detects valid cookies for a particular network request it will always tack those cookies onto the request, even if credentials: "omit" is passed to the fetch API.

This problem has been reported multiple times in #1274, which is an related issue that has been closed. I wanted to create a new issue to track it.

This problem makes it very difficult to fully encapsulate cookie logic within Javascript, and necessitates interacting directly with native cookie storage with something like react-native-cookies. This is unfortunate, as there is no particular reason that cookies ought to be handled natively, and outside of this problem it is possible to handle cookies entirely in Javascript.

Reproduction

1. First, get a cookie set on the client by hitting a server endpoint that returns a Set-Cookie header.
2. On Android,

await fetch(
  credentials: 'omit',
  ...
);

1. Add some logging code on the server to see if a Cookie header is set by client. Confirm that this is happening.

Solution

React Native on Android should respect the credentials: 'omit' option.

Additional Information

• React Native version: 42
• Platform: Android only
• Operating System: macOS

[GetSource1234]

Spotted the same issue, would be great to have a proper fix.

[2DKot]

If you are using Expo, you can’t run react-native link to use react-native-cookie. But you can clear cookies this way:

var RCTNetworking = require('RCTNetworking')
function clearCookies () {
  RCTNetworking.clearCookies((cleared) => {
    console.log('Cookies cleared, had cookies=' + cleared.toString())
  })
}

Maybe it will help someone.