fix(android): separate local storage between WebView processes

CHANGELOG.md

@@ -6,6 +6,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The changes documented here do not include those from the original repository.
 
+## 2.0.0
+
+### Fixes
+
+- Android: isolate WebView local storage and cookies from the main app by default on Android 28+. [RMET-4918](https://outsystemsrd.atlassian.net/browse/RMET-4918)
+
+### BREAKING CHANGES
+
+- Android: `openInWebView` now isolates WebView storage by default on Android 28+. Apps that need to share the main app WebView's `localStorage` or cookies must set `android.isIsolated` to `false`.
+
 ## 1.6.5
 
 ### Fixes

README.md

@@ -16,6 +16,19 @@ It's also possible to install via the repo's URL directly.
 cordova plugin add https://github.com/OutSystems/cordova-outsystems-inappbrowser
 ```
 
+#### LocalStorage Isolation
+The `openInWebView` option provides isolation for `localStorage` and `cookies` to ensure that content loaded in the InAppBrowser does not interfere with the main application's storage.
+
+- **iOS**: Storage is isolated by default.
+- **Android (API 28+)**: Storage is isolated by default by running the InAppBrowser in a separate process (`:OSInAppBrowser`) with a dedicated data directory suffix.
+- **Android (API < 28)**: Storage is **shared** with the main application due to platform limitations. On these devices, if the URL opened has the same origin as the main app, they will share the same `localStorage`.
+
+If your use case requires sharing `localStorage` or cookies between the main app and the InAppBrowser on Android, you can opt out of isolation by setting `isIsolated: false` in the `android` options.
+
+> Disabling isolation reduces the security of your app by allowing potentially untrusted web content to access your application's private storage. Use this only if necessary.
+
+> **Breaking Change (Android)**: Apps upgrading to this version will lose any existing `localStorage` or cookies previously stored by the InAppBrowser on Android 28+ on the first run. This is because the WebView now runs in a separate process with its own data directory. Users may need to re-authenticate with websites that relied on persisted session data.
+
 ## Supported Platforms
 
 - iOS
@@ -104,6 +117,7 @@ The action is composed of the following parameters:
 		- **allowZoom**: A boolean that, if set to true, shows the Android browser's zoom controls.
 		- **hardwareBack**: A boolean that, if set to true, uses the hardware back button to navigate backwards through the Web View's history. If there is no previous page, the Web View will close.
 		- **pauseMedia**: A boolean that, if set to true, makes the Web View pause/resume with the app to stop background audio. Note that this may be required to avoid Google Play issues like YouTube video playback while the application is in the background.
+		- **isIsolated**: A boolean that, if set to true, runs the InAppBrowser in an isolated WebView process on Android 28+. Defaults to true.
 	- **iOS**: iOS-specific Web View options.
 		- **allowOverScroll**:  A boolean that, if set to true, turns on the Web View bounce property.
 		- **enableViewportScale**: A boolean that, if set to true, prevents viewport scaling through a meta tag.
@@ -145,4 +159,4 @@ The action is composed of the following parameters:
 |OS-PLUG-IABP-0009|SafariViewController couldn't open the following URL: '\(url)'|:white_check_mark:|:x:|
 |OS-PLUG-IABP-0010|Custom Tabs couldn't open the following URL: '\(url)'|:x:|:white_check_mark:|
 |OS-PLUG-IABP-0011|The WebView couldn't open the following URL: '\(url)'|:white_check_mark:|:white_check_mark:|
-|OS-PLUG-IABP-0012|There’s no browser view to close.|:white_check_mark:|:white_check_mark:|
+|OS-PLUG-IABP-0012|There’s no browser view to close.|:white_check_mark:|:white_check_mark:|

dist/definitions.d.ts

@@ -56,6 +56,7 @@ export interface AndroidWebViewOptions {
     allowZoom: boolean;
     hardwareBack: boolean;
     pauseMedia: boolean;
+    isIsolated?: boolean;
 }
 export declare enum DismissStyle {
     CLOSE = 0,

dist/plugin.cjs

@@ -46,7 +46,8 @@ var CallbackEventType = /* @__PURE__ */ ((CallbackEventType2) => {
 const DefaultAndroidWebViewOptions = {
   allowZoom: false,
   hardwareBack: true,
-  pauseMedia: true
+  pauseMedia: true,
+  isIsolated: true
 };
 const DefaultiOSWebViewOptions = {
   allowOverScroll: true,

dist/plugin.js

@@ -47,7 +47,8 @@
   const DefaultAndroidWebViewOptions = {
     allowZoom: false,
     hardwareBack: true,
-    pauseMedia: true
+    pauseMedia: true,
+    isIsolated: true
   };
   const DefaultiOSWebViewOptions = {
     allowOverScroll: true,

dist/plugin.mjs

@@ -44,7 +44,8 @@ var CallbackEventType = /* @__PURE__ */ ((CallbackEventType2) => {
 const DefaultAndroidWebViewOptions = {
   allowZoom: false,
   hardwareBack: true,
-  pauseMedia: true
+  pauseMedia: true,
+  isIsolated: true
 };
 const DefaultiOSWebViewOptions = {
   allowOverScroll: true,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "com.outsystems.plugins.inappbrowser",
-  "version": "1.6.5",
+  "version": "2.0.0",
   "description": "InAppBrowser OutSystems Cordova Plugin",
   "keywords": [
     "ecosystem:cordova",

plugin.xml

@@ -1,5 +1,5 @@
 <?xml version='1.0' encoding='utf-8'?>
-<plugin id="com.outsystems.plugins.inappbrowser" version="1.6.5" xmlns="http://apache.org/cordova/ns/plugins/1.0" xmlns:android="http://schemas.android.com/apk/res/android">
+<plugin id="com.outsystems.plugins.inappbrowser" version="2.0.0" xmlns="http://apache.org/cordova/ns/plugins/1.0" xmlns:android="http://schemas.android.com/apk/res/android">
     <name>cordova-outsystems-inappbrowser</name>
     <description>InAppBrowser OutSystems Cordova Plugin</description>
     <author>OutSystems Inc</author>
@@ -25,6 +25,7 @@
         <source-file src="src/android/OSInAppBrowserError.kt" target-dir="app/src/main/kotlin/com/outsystems/plugins/inappbrowser/osinappbrowser" />
 
         <framework src="src/android/build.gradle" custom="true" type="gradleReference" />
+        <lib-file src="src/android/libs/OSInAppBrowserLib-debug.aar" />
         <source-file src="src/android/OSInAppBrowserSystemBrowserInputArguments.kt" target-dir="app/src/main/kotlin/com/outsystems/plugins/inappbrowser/osinappbrowser" />
         <source-file src="src/android/OSInAppBrowserWebViewInputArguments.kt" target-dir="app/src/main/kotlin/com/outsystems/plugins/inappbrowser/osinappbrowser" />
     </platform>

src/android/OSInAppBrowser.kt

@@ -268,7 +268,8 @@ class OSInAppBrowser: CordovaPlugin() {
                 it.android.allowZoom ?: true,
                 it.android.hardwareBack ?: true,
                 it.android.pauseMedia ?: true,
-                it.customWebViewUserAgent
+                it.customWebViewUserAgent,
+                it.android.isIsolated ?: true
             )
         }
     }

src/android/OSInAppBrowserWebViewInputArguments.kt

@@ -20,5 +20,6 @@ data class OSInAppBrowserWebViewInputArguments(
 data class OSInAppBrowserWebViewAndroidOptions(
     @SerializedName("allowZoom") val allowZoom: Boolean?,
     @SerializedName("hardwareBack") val hardwareBack: Boolean?,
-    @SerializedName("pauseMedia") val pauseMedia: Boolean?
+    @SerializedName("pauseMedia") val pauseMedia: Boolean?,
+    @SerializedName("isIsolated") val isIsolated: Boolean?
 )

src/android/build.gradle

@@ -10,7 +10,7 @@ buildscript {
 }
 
 dependencies{
-    implementation("io.ionic.libs:ioninappbrowser-android:1.6.2@aar")
+    implementation("io.ionic.libs:ioninappbrowser-android:2.0.0@aar")
 
     implementation("androidx.browser:browser:1.8.0")
     implementation("com.google.android.gms:play-services-auth:21.2.0")

src/www/defaults.ts

@@ -3,7 +3,8 @@ import { AndroidAnimation, AndroidSystemBrowserOptions, AndroidViewStyle, Androi
 export const DefaultAndroidWebViewOptions: AndroidWebViewOptions = {
     allowZoom: false,
     hardwareBack: true,
-    pauseMedia: true
+    pauseMedia: true,
+    isIsolated: true
 }
 
 export const DefaultiOSWebViewOptions: iOSWebViewOptions = {
@@ -58,4 +59,4 @@ export const DefaultAndroidSystemBrowserOptions: AndroidSystemBrowserOptions = {
 export const DefaultSystemBrowserOptions: SystemBrowserOptions = {
     android: DefaultAndroidSystemBrowserOptions,
     iOS: DefaultiOSSystemBrowserOptions
-}
+}

src/www/definitions.ts

@@ -72,6 +72,7 @@ export interface AndroidWebViewOptions {
   allowZoom: boolean;
   hardwareBack: boolean;
   pauseMedia: boolean;
+  isIsolated?: boolean;
 }
 
 export enum DismissStyle {