Skip to content

Say that Forget signs you out of every site in the app #255

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xroche merged 4 commits into from
Oct 21, 2026
Merged

Say that Forget signs you out of every site in the app #255

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
aefdb40
Send a captured cookie to its own host only
xroche Oct 21, 2026
5e66c48
Shorten two comments the review flagged
xroche Oct 21, 2026
a218b37
Narrow this PR to the Forget fix, and fix what the review found
xroche Oct 21, 2026
549c566
Keep the wide clear, and say what it does
xroche Oct 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion app/src/main/java/com/httrack/android/BrowserLoginActivity.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,7 +208,18 @@ public boolean onOptionsItemSelected(final MenuItem item) {
return super.onOptionsItemSelected(item);
}

/** Drop the saved session: the browser's cookies and the file the engine would have read. */
/**
* Drop the saved session: the browser's cookies and the file the engine would have read.
*
* This signs the user out of every site in this app's browser, not just this project's. That
* is deliberate. CookieManager has no per-site removal, and nothing enumerates what a
* narrower pass would miss: getCookie answers for one path, so a cookie on a deeper path is
* invisible to it, a nameless cookie has no name to overwrite, and a session held by an
* iframe sign-on sits on a host onPageStarted never reported. A narrower Forget was measured
* and it left all three signed in, which is worse than reaching too far, because the user
* presses this to change accounts. The store is per app, so splitting it needs a per-project
* WebView data directory, which means a separate process.
*/
private void forget() {
if (cookiesFile == null) {
return;
Expand Down
2 changes: 1 addition & 1 deletion app/src/main/res/values/strings.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -285,7 +285,7 @@
<string name="browser_login_note">Log in to the site here, then tap \"Use this login\". Google accounts refuse this window.</string>
<string name="browser_login_done">Use this login</string>
<string name="browser_login_forget">Forget the saved login</string>
<string name="browser_login_forgotten">The saved login is deleted.</string>
<string name="browser_login_forgotten">The saved login is deleted. This also signs you out of every site in the browser inside this app.</string>
<string name="browser_login_no_address">Type a web address first.</string>
<string name="browser_login_no_project">Give the project a name first.</string>
<string name="browser_login_https_only">This window opens https addresses only.</string>
Expand Down
Loading